REDHAT-BUG-2555574: Integer Overflow
A flaw was found in the GIMP PSD plug-in thumbnail loader. When a PSD embeds a grayscale JPEG thumbnail, the BGR-to-RGB swap in loadresource1033() uses a hard-coded 3-byte stride without checking the JPEG component count, reading and writing past the heap buffer. The overflow length is controlled by the file. This can be triggered during thumbnail generation in the file chooser, without fully opening the image. This is distinct from CVE-2026-92248 (thumbnail allocation integer overflow).
Affected Software
Event History
Frequently Asked Questions
Can this be triggered without opening a PSD image in GIMP?
Yes. The flaw can be triggered while GIMP generates a thumbnail in the file chooser, so fully opening the image is not required.
What kind of file is needed to trigger the issue?
An attacker would need to provide a PSD file containing an embedded grayscale JPEG thumbnail. The file controls the overflow length.