Description
A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.
Published: 2026-07-03
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the GIMP Paint Shop Pro image parser results in a heap buffer overflow (CWE-122). When GIMP opens low‑bit‑depth PSP files it incorrectly calculates buffer sizes, causing adjacent memory to be overwritten. An attacker who entices a user to open a specially crafted file can therefore achieve arbitrary code execution or cause a denial of service on the victim machine.

Affected Systems

The vulnerability affects Red Hat Enterprise Linux releases 6, 7, 8, and 9, because GIMP is delivered as a package in those distributions. The CNA has not specified which GIMP versions are impacted, so the exact version numbers bundled with each distribution are unknown.

Risk and Exploitability

The CVSS score of 7.3 indicates moderate to high severity, while the EPSS score of < 1% shows a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacking requires a user to open a malicious PSP file, which is a user‑based, social‑engineering vector that can lead to remote code execution or system crash.

Generated by OpenCVE AI on August 1, 2026 at 20:27 UTC.

Remediation

Vendor Workaround

To mitigate this vulnerability, users should avoid opening untrusted Paint Shop Pro (PSP) image files with GIMP. As a general security practice, it is recommended to only process image files from trusted sources. If GIMP is not essential, consider removing the package to eliminate the attack surface.

OpenCVE Recommended Actions

  • Avoid opening untrusted Paint Shop Pro image files with GIMP.
  • Process only image files from trusted sources.
  • If GIMP is not required, consider removing the package to eliminate the attack surface.

Generated by OpenCVE AI on August 1, 2026 at 20:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Gimp
Gimp gimp
Vendors & Products Gimp
Gimp gimp

Mon, 13 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
References

Tue, 07 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.
Title Gimp: gimp: heap buffer overflow in read_channel_data()
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-122
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Gimp Gimp
Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-13T10:55:42.400Z

Reserved: 2026-06-30T16:54:04.312Z

Link: CVE-2026-58379

cve-icon Vulnrichment

Updated: 2026-07-06T18:13:07.982Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-03T19:16:37.040

Modified: 2026-07-13T12:16:34.790

Link: CVE-2026-58379

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T20:30:12Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow