CVE-2026-119528
Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in GIMP PSD Plugin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: redhat-SADP

Description
A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119528
EUVD
EUVD-2026-113948

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in GIMP's PSD plug-in. When processing a crafted PSD file, the plug-in incorrectly copies a resource name into a fixed stack buffer using the wrong destination size. This can lead to a crash and potentially allow arbitrary code execution.

Impact Analysis

If you open a malicious PSD file with GIMP, the vulnerability could crash the application or allow an attacker to execute arbitrary code on your system. This could lead to data theft, system compromise, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR or HIPAA requirements for data protection and security. Organizations using affected GIMP versions may face compliance violations and legal consequences.

Mitigation Strategies

Update GIMP to the latest patched version immediately to address the stack-based buffer overflow in the PSD plug-in. Avoid opening untrusted PSD files until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart