CVE-2026-92248
Fixed in a distro release EPSS <1%CVSS 7.8
A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.
Products: GNOME GIMP, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | gimp | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
| AlmaLinux 8 | gimp-devel | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
| AlmaLinux 8 | gimp-devel-tools | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
| AlmaLinux 8 | gimp-libs | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
| AlmaLinux 8 | pygobject2 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux 8 | pygobject2-codegen | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux 8 | pygobject2-devel | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux 8 | pygobject2-doc | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux 8 | pygtk2 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux 8 | pygtk2-codegen | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux 8 | pygtk2-devel | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux 8 | pygtk2-doc | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux 8 | python2-cairo | 1.16.3-7.module_el8.10.0+4267+35168c80 |
| AlmaLinux 8 | python2-cairo-devel | 1.16.3-7.module_el8.10.0+4267+35168c80 |
| AlmaLinux 9 | gimp | 2:3.0.4-4.el9_8.14 |
| AlmaLinux 9 | gimp-libs | 2:3.0.4-4.el9_8.14 |
| Debian 12 | gimp | no fix |
| Debian 13 | gimp | 3.0.4-3+deb13u11 |
| Debian 14 | gimp | no fix |
| Red Hat Enterprise Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | gimp-debuginfo | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | gimp-debugsource | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | gimp-devel | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | gimp-devel-tools | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | gimp-devel-tools-debuginfo | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | gimp-libs | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | gimp-libs-debuginfo | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
| Red Hat Enterprise Linux 8 | pygobject2 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | pygobject2-codegen | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | pygobject2-debuginfo | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | pygobject2-debugsource | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | pygobject2-devel | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | pygobject2-doc | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | pygtk2 | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
| Red Hat Enterprise Linux 8 | pygtk2-codegen | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
| Red Hat Enterprise Linux 8 | pygtk2-debuginfo | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
| Red Hat Enterprise Linux 8 | pygtk2-debugsource | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
| Red Hat Enterprise Linux 8 | pygtk2-devel | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
| Red Hat Enterprise Linux 8 | pygtk2-doc | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
| Red Hat Enterprise Linux 8 | python2-cairo | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | python2-cairo-debuginfo | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | python2-cairo-devel | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | python2-pycairo | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 8 | python2-pycairo-debugsource | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
| Red Hat Enterprise Linux 9 | gimp | 2:3.0.4-4.el9_8.14 |
| Red Hat Enterprise Linux 9 | gimp-debuginfo | 2:3.0.4-4.el9_8.14 |
| Red Hat Enterprise Linux 9 | gimp-debugsource | 2:3.0.4-4.el9_8.14 |
| Red Hat Enterprise Linux 9 | gimp-devel-tools-debuginfo | 2:3.0.4-4.el9_8.14 |
| Red Hat Enterprise Linux 9 | gimp-libs | 2:3.0.4-4.el9_8.14 |
| Red Hat Enterprise Linux 9 | gimp-libs-debuginfo | 2:3.0.4-4.el9_8.14 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 |
| Rocky Linux 8 | pygobject2 | 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 |
| Rocky Linux 8 | pygtk2 | 0:2.24.0-25.module+el8.9.0+1723+9bc93544 |
| Rocky Linux 8 | python2-pycairo | 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | gimp | 2.10.30-150400.3.79.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | gimp | 2.10.30-150400.3.79.1 |
| Ubuntu 26.04 LTS | gimp | no fix |
| Ubuntu 26.10 | gimp | no fix |
| Ubuntu Pro 16.04 LTS | gimp | no fix |
| Ubuntu Pro 18.04 LTS | gimp | no fix |
| Ubuntu Pro 20.04 LTS | gimp | no fix |
| Ubuntu Pro 22.04 LTS | gimp | no fix |
| Ubuntu Pro 24.04 LTS | gimp | no fix |
| openSUSE Leap 16.0 | gimp | 3.0.8-bp160.10.1 |
| openSUSE Tumbleweed | gimp | 3.2.6-3.1 |