CVE-2026-58379: GIMP PSP File Heap Buffer Overflow Remote Code Execution

Technical summary

CVE-2026-58379 is a heap buffer overflow (CWE-122) in GIMP's PSP file format parser. The flaw manifests in the low bit-depth image processing code path, where buffer size calculations are incorrect, permitting out-of-bounds writes to adjacent heap memory. The parser fails to properly validate or constrain the size of image data before writing, allowing heap corruption that can be leveraged for code execution or denial of service. The vulnerability is reachable through a file-open operation, making it accessible to any user with the ability to open files in GIMP.

Business impact

For organizations relying on GIMP for image editing or batch image processing workflows, this vulnerability poses a direct code execution risk. Attackers can distribute malicious PSP files via email, shared drives, or compromised repositories to compromise endpoints. In environments where GIMP processes untrusted image content (design agencies, media companies, automated image pipelines), this is a critical pathway for lateral movement or data theft. Even denial-of-service impact disrupts productivity; in automated workflows, a crash could halt batch operations and obscure the attack vector.

Affected systems

GIMP (GNU Image Manipulation Program) versions are affected; the exact affected versions depend on vendor patch releases. The vulnerability specifically impacts GIMP's PSP file parser, so systems with GIMP installed and configured to handle PSP files are at risk. Users who do not open PSP files are at lower risk, but because file associations and drag-and-drop operations can trigger parsing, isolation is not guaranteed. No other vendors or products are documented as affected by this specific flaw.

Exploitability

The vulnerability requires user interaction: a user must be convinced to open a malicious PSP file. No authentication or elevated privileges are needed to trigger it, and GIMP is a freely available, widely distributed application. The attack surface includes email attachments, shared folders, web downloads, and messaging platforms. However, the requirement for explicit user action (opening a file) moderates the immediate threat compared to network-based remote code execution flaws. An attacker with social engineering capability or distribution access can reliably craft and deliver exploit files.

Remediation

Apply security patches released by the GIMP project. Verify the patched version against the official GIMP advisory and release notes, as this assessment does not specify exact patch versions. Organizations should also enforce application whitelisting or sandboxing of GIMP if it is used in high-risk environments, restrict PSP file handling to trusted sources, and educate users not to open image files from unknown origins. Users running older, unsupported GIMP builds should upgrade to the latest stable version.

Patch guidance

Monitor GIMP's official release channels (gimp.org) and security advisories for patched versions addressing this heap buffer overflow. Test patches in a non-production environment before wide deployment, as GIMP updates may affect plugins or workflows. Organizations using GIMP in CI/CD or batch processing pipelines should test image processing scripts against patched versions to ensure compatibility. If immediate patching is not feasible, disable PSP file support in GIMP or prevent users from opening untrusted PSP files.

Detection guidance

Monitor for crashes or unexpected terminations of GIMP processes, particularly when processing PSP files. Endpoint detection and response (EDR) solutions should flag heap corruption or memory corruption exploitation patterns. Network detection: watch for distribution of suspicious PSP files via email or file-sharing protocols to GIMP users. File reputation scanning can identify malicious PSP samples, though custom-crafted exploits may evade signatures. Process memory analysis during incident response can reveal heap overwrite artifacts and code injection.

Why prioritize this

This vulnerability merits HIGH priority due to its code execution capability and relatively low exploitation barrier (social engineering via file distribution). While user interaction is required, GIMP's ubiquity in design and media workflows makes it a viable attack vector. Organizations with designers, image editors, or content teams should patch expeditiously. The heap buffer overflow class is well-understood and reliably exploitable; adversaries can quickly weaponize proof-of-concept code. The CVSS score of 7.3 reflects local attack surface and user interaction, but the practical impact justifies urgent remediation.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: local attack vector (AV:L—file must be opened locally), low attack complexity (AC:L—no special conditions required beyond crafted file), low privileges required (PR:L—user account suffices), but mandatory user interaction (UI:R). Confidentiality, integrity, and availability impacts are all HIGH, indicating code execution or DoS. The score does not account for GIMP's distribution and use in media pipelines, which increases real-world risk; organizations handling sensitive images should treat this as a priority above the base score alone.

Frequently asked questions