GIMP: PSD plug-in stack-based buffer overflow (CVE-2026-119528)
GIMP contains a stack-based buffer overflow vulnerability in the PSD plug-in image resource header loader, allowing an attacker to execute arbitrary code via a crafted PSD file.
CVE search metadata
CVE search record: CVE-2026-119528. Severity: high. CVSS: 7.8. KEV: no. Product: GIMP. Brief: GIMP: PSD plug-in stack-based buffer overflow (CVE-2026-119528). Brief link: https://feed.craftedsignal.io/briefs/2026-10-gimp-psd-overflow/
Triage facts
Revision 1- Applicability
- GIMP
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 17:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in the GIMP PSD plug-in where the image resource header loader performs an incorrect destination size calculation when copying a resource name into a fixed stack buffer. This flaw enables a stack-based buffer overflow, which can be exploited by an attacker providing a specially crafted PSD file. Successful exploitation may result in an application crash or arbitrary code execution within the context of the GIMP process.
Impact
An attacker can achieve arbitrary code execution on a target system by convincing a user to open a malicious PSD file in GIMP. The vulnerability also poses a risk of denial-of-service via application crashing.
Recommendation
- Audit workstation inventory to identify instances of GIMP where PSD file handling is enabled.
- Advise users to avoid opening untrusted or unsolicited PSD files until a patch is applied.
- Monitor for GIMP process crashes on systems that frequently process image files.
- Monitor official GIMP security releases and apply patches for CVE-2026-119528 as soon as they become available.
Threat Hunt
Identify GIMP process crashes indicating potential exploitation attempts of the PSD plug-in.
Data: Windows Application Event Logs (Event ID 1000: Application Error), macOS System/Crash logs, Linux core dump logs
Mitigations
Monitor GIMP project releases and update GIMP to the first version containing a patch for CVE-2026-119528.
CVE-2026-119528