CVE-2026-82343

Analyzed Analyzed - Analysis Complete

Heap Out-of-Bounds Read in GIMP File-PSD Plugin

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: redhat-SADP

Description

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-82343

EUVD

EUVD-2026-67826

Affected Vendors & Products

Vendor	Product	Version / Range
gimp	gimp	to 3.3.1 (inc)
redhat	enterprise_linux	7.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory corruption issue in GIMP's file-psd plugin. When processing a specially crafted PSD image file, the plugin fails to validate the channel-count parameter properly. This leads to incorrect memory bounds checking, causing both a heap out-of-bounds read and a stack out-of-bounds access. The result can be an application crash, leading to denial of service or limited information disclosure of memory contents.

Detection Guidance

This vulnerability is triggered by opening a malicious PSD file with GIMP's file-psd plugin. Detection involves monitoring for crashes when processing PSD files or analyzing GIMP logs for memory access errors. No specific commands are provided in the resources, but you can check GIMP's crash logs or use system monitoring tools to detect application crashes during PSD file processing.

Impact Analysis

If you open a malicious PSD file, the vulnerability could crash GIMP, causing a denial of service. It might also expose limited memory contents, though the impact is likely small. The risk is higher if you frequently open files from untrusted sources.

Compliance Impact

This vulnerability primarily causes application crashes (denial of service) or limited memory disclosure, which may indirectly impact compliance by disrupting data processing or exposing sensitive information. However, the provided context does not specify direct effects on GDPR or HIPAA compliance.

Mitigation Strategies

Avoid opening PSD files from untrusted or unknown sources.
Update GIMP to the latest version once a patch is released.
Use alternative image viewers for PSD files until the issue is resolved.
Monitor GIMP for crashes when processing PSD files as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-82343. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70