GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28807.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-cairoUpgrade pygobject2-docUpgrade pygobject2-develUpgrade pygtk2-codegenUpgrade pygtk2-develUpgrade gimp-develUpgrade pygobject2Upgrade gimp-devel-toolsUpgrade pygobject2-codegenUpgrade python2-cairo-develUpgrade pygtk2Upgrade gimp-libsUpgrade pygtk2-docUpgrade gimp | May 14, 2026 | May 12, 2026 |
| Amazon Linux Ami 2 | — | Upgrade gimp-devel-toolsUpgrade gimpUpgrade gimp-debuginfoUpgrade gimp-develUpgrade gimp-libs | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade gimp | Apr 20, 2026 | Apr 20, 2026 |
| Oracle_linux | — | Upgrade python2-cairo-develUpgrade pygtk2-codegenUpgrade gimpUpgrade pygobject2-develUpgrade pygobject2-codegenUpgrade pygtk2-develUpgrade pygobject2-docUpgrade gimp-devel-toolsUpgrade pygobject2Upgrade gimp-develUpgrade python2-cairoUpgrade pygtk2-docUpgrade pygtk2Upgrade gimp-libs | May 21, 2026 | Apr 11, 2026 |
| Redhat_linux | — | Upgrade gimp-libs-debuginfoUpgrade gimp-libsUpgrade python2-cairo-develNo solution existsUpgrade python2-cairo-debuginfoUpgrade gimp-develUpgrade gimp-debuginfoUpgrade gimp-devel-tools-debuginfoUpgrade pygtk2Upgrade pygobject2-develUpgrade gimp-debugsourceUpgrade pygtk2-debugsourceUpgrade pygtk2-codegenUpgrade gimp-devel-toolsUpgrade pygobject2Upgrade gimpUpgrade pygobject2-debuginfoUpgrade python2-pycairo-debugsourceUpgrade pygtk2-docUpgrade pygobject2-codegenUpgrade pygtk2-develUpgrade pygobject2-debugsourceUpgrade pygtk2-debuginfoUpgrade python2-cairoUpgrade pygobject2-doc | May 13, 2026 | Apr 11, 2026 |
| Rocky_linux | — | Upgrade gimp-debugsourceUpgrade pygobject2Upgrade python2-pycairo-debugsourceUpgrade python2-cairo-debuginfoUpgrade pygobject2-codegenUpgrade pygtk2-develUpgrade gimp-libs-debuginfoUpgrade python2-cairoUpgrade pygobject2-docUpgrade pygtk2Upgrade gimp-libsUpgrade gimp-devel-tools-debuginfoUpgrade pygtk2-debuginfoUpgrade gimp-devel-toolsUpgrade gimp-develUpgrade pygobject2-develUpgrade pygtk2-debugsourceUpgrade python2-cairo-develUpgrade pygtk2-codegenUpgrade pygobject2-debuginfoUpgrade gimp-debuginfoUpgrade gimpUpgrade pygobject2-debugsource | May 18, 2026 | May 14, 2026 |
| Suse | — | Upgrade libgimp-3_0-0Upgrade libgimpui-3_0-0Upgrade gimp-develUpgrade gimp-extension-goat-excercisesUpgrade libgimpui-2_0-0-32bitUpgrade gimp-plugin-aaUpgrade gimp-langUpgrade libgimp-2_0-0-32bitUpgrade gimpUpgrade gimp-valaUpgrade gimp-plugin-python3Upgrade libgimp-2_0-0Upgrade libgimpui-2_0-0 | Mar 30, 2026 | Mar 30, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub