UBUNTU-CVE-2026-119528: Buffer Overflow
Published Nov 3, 2026
·Updated
A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
Affected Software
7 affected components
ubuntu/gimp*
ubuntu/gimp*
ubuntu/gimp*
ubuntu/gimp*
ubuntu/gimp*
ubuntu/gimp*
ubuntu/gimp*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attack requires a local attack vector and user interaction: a user must open a crafted PSD file in GIMP. No privileges are required by the attacker.
2
What could happen if exploitation succeeds?
Opening the crafted file can trigger a stack-based buffer overflow in the PSD plug-in, causing GIMP to crash and potentially allowing arbitrary code execution with the affected user's privileges.