CVE-2026-58384: GIMP PSD Parser Integer Overflow – Heap Corruption Risk

Technical summary

CVE-2026-58384 is an integer overflow vulnerability in GIMP's PSD parser, specifically within the read_RLE_channel() function. The flaw occurs during RLE (Run-Length Encoded) decompression when processing channel data in PSD files. An integer overflow causes the heap allocation for the RLE row-length table to be undersized relative to the actual data written per row, resulting in a classic heap buffer overflow. Subsequent write operations corrupt adjacent heap memory, potentially enabling denial of service or code execution depending on heap layout and exploitation sophistication.

Business impact

Organizations relying on GIMP for batch processing of untrusted PSD files face operational risk. A malicious PSD could crash automated workflows, disrupt design pipelines, or potentially allow an attacker to execute code within the context of the GIMP process. For users opening files from external sources (clients, online repositories, email), the attack surface is broader. Red Hat Enterprise Linux users are affected through GIMP packages bundled in those distributions.

Affected systems

GIMP installations across Linux distributions and other platforms are affected. Red Hat Enterprise Linux is explicitly listed as an affected vendor product. The vulnerability exists in the core PSD parser and affects any GIMP version containing the vulnerable read_RLE_channel() code until patching is applied.

Exploitability

Exploitation requires local access to the target system and user interaction—the victim must open a malicious PSD file in GIMP. The attack vector is local, privileges required are low (an unprivileged user can be targeted), and the user must actively open the file (though social engineering can facilitate this). The low barrier to exploitation is offset somewhat by the requirement for manual file opening, but the prevalence of file-sharing and untrusted PSD downloads keeps risk elevated.

Remediation

Apply security updates from your GIMP distributor or from gimp.org once they are released. Red Hat Enterprise Linux users should check for GIMP package updates through their subscription channels. Verify patch availability against the vendor advisory before deployment. Until patching, restrict PSD file opening to trusted sources and consider disabling GIMP's PSD parsing if not essential for your workflow.

Patch guidance

Monitor GIMP's official website and security advisories for patched versions addressing CVE-2026-58384. For Red Hat Enterprise Linux, check the Red Hat Security Advisories portal for GIMP errata. Prioritize deployment in environments where users regularly handle externally sourced PSD files. Test patches in a non-production environment before rolling out organization-wide.

Detection guidance

Monitor process logs for GIMP crashes or segmentation faults correlating with PSD file access. Endpoint Detection and Response (EDR) solutions may flag heap corruption or unusual memory access patterns. Network-based detection is limited because the attack is local; focus on file analysis to identify maliciously crafted PSD files if your organization performs file intake screening. Consider sandboxing PSD parsing if feasible.

Why prioritize this

With a CVSS score of 7.3 (HIGH), this vulnerability warrants prompt attention. It combines high confidentiality, integrity, and availability impact with a low-barrier local attack vector and low privilege requirements. Although not currently listed in CISA's Known Exploited Vulnerabilities catalog, the relative simplicity of crafting a malicious PSD file and the risk of code execution justify elevated priority, especially for organizations processing untrusted design files.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects the high impact potential (confidentiality, integrity, and availability all affected) balanced against the local-only attack vector and requirement for user interaction. The integer overflow is a well-understood primitive in memory corruption attacks, making reliable exploitation plausible. The score does not indicate active in-the-wild exploitation or weaponization; however, the technical nature of the flaw suggests that proof-of-concept development is probable post-disclosure.

Frequently asked questions