CVE-2026-112257

Awaiting Analysis Awaiting Analysis - Queue

Heap Out-of-Bounds Read in GIMP PSD Thumbnail Loader

Publication date: 2026-10-19

Last updated on: 2026-11-05

Assigner: redhat-SADP

Description

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-11-05

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-112257

EUVD

EUVD-2026-104651

Affected Vendors & Products

Vendor	Product	Version / Range
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 7	*
Red Hat	Red Hat Enterprise Linux 8	*
Red Hat	Red Hat Enterprise Linux 9	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is in GIMP, an image editing software. When processing PSD files with grayscale thumbnails, GIMP incorrectly swaps color channels without checking if the thumbnail is RGB. This causes a memory error where data is read and written outside expected bounds, potentially crashing the program or allowing arbitrary code execution.

Detection Guidance

This vulnerability can be detected by checking for GIMP versions affected by the PSD thumbnail loader flaw. Update GIMP to the latest version and scan files for malformed PSD thumbnails. No specific commands are provided in the context.

Impact Analysis

If you open or browse a malicious PSD file, your GIMP installation could crash or execute arbitrary code. This might allow an attacker to take control of your system, steal data, or install malware. The risk is higher if you handle untrusted files regularly.

Compliance Impact

This vulnerability could potentially lead to arbitrary code execution when a victim opens a crafted PSD file. This may result in unauthorized access to sensitive data, which could violate GDPR or HIPAA compliance if personal or health information is exposed.

Mitigation Strategies

Update GIMP to the latest patched version to address the PSD thumbnail resource loader flaw. Avoid opening untrusted PSD files until patched. Monitor for crashes or unusual behavior when handling image files.

Hi! I’m here to help you understand CVE-2026-112257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...