GNOME - CraftedSignal Threat Feed

CVE-2026-58384: GIMP PSD Parser Integer Overflow Leads to RCE/DoS

hello@craftedsignal.io — Tue, 07 Jul 2026 09:18:26 +0000

CVE-2026-58384 describes a critical flaw in the GIMP (GNU Image Manipulation Program) PSD (Photoshop Document) parser. Specifically, an integer overflow occurs within the read_RLE_channel() function. This vulnerability arises when processing specially crafted PSD files, causing an undersized heap allocation for the Run-Length Encoding (RLE) row-length table. Following this incorrect allocation, subsequent per-row writes attempt to use more memory than allocated, leading to heap memory corruption. This memory corruption can have severe consequences, including the application crashing (denial of service) or, in a more advanced scenario, the execution of arbitrary code on the affected system. The vulnerability has a CVSS v3.1 base score of 7.3 (High) and affects GIMP, including its package within Red Hat Enterprise Linux 9.

Attack Chain

An attacker crafts a malicious PSD file designed to trigger an integer overflow in GIMP's parser.
The malicious PSD file contains specially formatted RLE channel data intended to cause an undersized buffer allocation.
A user is enticed to open the malicious PSD file using an affected version of the GIMP application.
GIMP's read_RLE_channel() function begins processing the RLE channel data from the malicious file.
During the calculation for the RLE row-length table allocation, an integer overflow occurs due to the crafted input.
This integer overflow results in an undersized heap allocation for the RLE row-length table, creating a buffer overflow condition.
Subsequent writes by the read_RLE_channel() function, intended for per-row data, exceed the boundary of the undersized buffer, corrupting adjacent heap memory.
This heap memory corruption ultimately leads to either a denial-of-service condition (e.g., GIMP application crash) or, under specific exploit conditions, arbitrary code execution in the context of the user running GIMP.

Impact

The impact of CVE-2026-58384 is significant, potentially leading to application instability, data loss, or complete system compromise. If exploited for denial of service, GIMP users would experience application crashes, hindering productivity. More critically, successful exploitation for arbitrary code execution could allow an attacker to run malicious code with the privileges of the compromised user, potentially leading to further compromise of the system, data exfiltration, or installation of additional malware. While no specific victim counts or sectors are mentioned, any organization or individual using affected GIMP versions is at risk.

Recommendation

Update GIMP to a patched version immediately to remediate CVE-2026-58384, as referenced by the https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217 commit.
Apply security updates for Red Hat Enterprise Linux 9 if using the GIMP package, addressing CVE-2026-58384, as detailed in the Red Hat advisory https://access.redhat.com/security/cve/CVE-2026-58384.
Ensure all software, particularly applications that handle untrusted file formats, are kept up-to-date with the latest security patches.

CVE-2026-58380: GIMP PNM Parser Off-by-One Error Leads to RCE

hello@craftedsignal.io — Mon, 06 Jul 2026 15:25:56 +0000

CVE-2026-58380 details a critical vulnerability discovered in GIMP's PNM (Portable Anymap) image file format parser. The flaw resides within the pnmscanner_gettoken() function, where an off-by-one error during a loop boundary check causes a null terminator to be written one byte beyond the intended boundary of a stack-allocated buffer. This memory corruption is triggered when GIMP attempts to parse a specially crafted PNM file. While not yet observed in active exploitation, successful exploitation could lead to application instability and denial of service due to crashes, or, more severely, arbitrary code execution, granting an attacker control over the compromised system. This vulnerability affects various GIMP versions, including those shipped with Red Hat Enterprise Linux distributions.

Attack Chain

An attacker crafts a malicious PNM image file specifically designed to exploit the off-by-one error in GIMP's pnmscanner_gettoken() function.
The malicious PNM file is delivered to a victim through common vectors such as email attachments, malicious websites, or untrusted file shares.
The victim opens the specially crafted PNM file using the vulnerable GIMP application.
During the file parsing process, the pnmscanner_gettoken() function attempts to process the malicious input.
The off-by-one error causes a null byte to be written past the end of a stack buffer, corrupting adjacent memory.
This memory corruption disrupts program execution flow, leading to either an immediate application crash (denial of service) or, under controlled conditions, enables arbitrary code execution on the victim's system.

Impact

The vulnerability, CVE-2026-58380, carries a CVSS v3.1 Base Score of 7.3 (High), indicating significant potential impact. If successfully exploited, systems running vulnerable versions of GIMP could suffer from denial of service, where the application crashes, leading to loss of productivity. More critically, an attacker could achieve arbitrary code execution, allowing them to install malware, exfiltrate data, or gain full control over the compromised system. While there are no reports of in-the-wild exploitation, the widespread use of GIMP, particularly on Linux distributions like Red Hat Enterprise Linux, makes this a high-risk vulnerability.

Recommendation

Apply available patches for CVE-2026-58380 immediately to all GIMP installations, particularly on Red Hat Enterprise Linux systems, by referring to the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-58380.
Monitor Red Hat security channels for updates to affected products as detailed in the Red Hat advisory and apply them promptly.
Implement user awareness training regarding the risks associated with opening untrusted image files, especially those in less common formats like PNM.

Potential Proxy Execution via Systemd-run on Linux

hello@craftedsignal.io — Mon, 06 Jul 2026 14:39:26 +0000

This threat brief outlines a technique where adversaries utilize the systemd-run binary on Linux systems for proxy execution, a method aimed at defense evasion and enabling command execution. systemd-run is a legitimate system utility designed to schedule commands for background execution through systemd. Attackers can exploit this functionality to run malicious payloads, such as shells, downloaders, or credential-harvesting scripts, as transient services or scopes. This technique allows them to detach their processes, obscure the direct parent-child relationships in the process tree, and mask their activities behind a trusted system utility, significantly reducing visibility for defenders. The technique can be used post-initial access to establish persistence, expand access, or facilitate data exfiltration without directly revealing the true malicious parent process.

Attack Chain

An attacker gains initial access to a Linux system, often via exploitation of a vulnerable service, compromised credentials, or a successful phishing attempt.
After establishing a foothold, the attacker performs reconnaissance to understand the environment and identifies systemd-run as a potential tool for evading detection.
The attacker stages a malicious payload (e.g., a reverse shell script, a downloader for additional malware, or a credential harvesting tool) onto the compromised system, possibly in a temporary directory.
The attacker executes the malicious payload using systemd-run, typically with options like --user or --scope, to launch it as a transient systemd unit or scope, detaching it from the initiating process.
systemd-run acts as a proxy, launching the malicious command or script in the background, making it appear as a legitimate systemd-managed process.
The detached malicious payload executes, performing its intended actions such as establishing command and control, downloading further stages, escalating privileges, or exfiltrating data.
The attacker might configure persistence mechanisms within the transient unit definition or by other means, ensuring continued access even after the initial session ends.

Impact

If successful, attacks employing systemd-run for proxy execution can lead to significant compromises. Adversaries can execute arbitrary commands, establish covert persistence, download additional malicious tooling, or exfiltrate sensitive data without being easily detected through conventional process monitoring. The use of detached, transient units complicates forensic analysis and incident response by obfuscating the true origin and nature of the malicious processes. This can result in full system compromise, severe data breaches, unauthorized privilege escalation, or lateral movement across the network, making remediation challenging and prolonged.

Recommendation

Deploy the Sigma rule "Detect Potential Proxy Execution via Systemd-run" in this brief to your SIEM and tune for your environment.
When triggered by the Sigma rule, reconstruct the full process tree around the systemd-run event to determine which user, shell, script, service, or remote access session invoked it.
Review the exact command passed through systemd-run, including flags such as --user, --scope, scheduling options, or custom unit names, to classify the spawned payload as expected or suspicious.
Isolate any affected Linux host from the network immediately, and terminate the malicious systemd-run transient unit or scope along with any child processes it launched.
Remove attacker persistence by deleting unauthorized unit files and drop-ins from /etc/systemd/system/, /run/systemd/transient/, /var/lib/systemd/, and affected users’ ~/.config/systemd/user/ directories.

CVE-2026-58379: GIMP Heap Buffer Overflow in PSP Parser Allows RCE

hello@craftedsignal.io — Fri, 03 Jul 2026 19:18:57 +0000

A critical heap buffer overflow vulnerability, identified as CVE-2026-58379, has been discovered in GIMP's Paint Shop Pro (PSP) file format parser. This flaw allows a remote attacker to achieve arbitrary code execution or a denial of service (DoS) on affected systems. The vulnerability is triggered when a user is tricked into opening a specially crafted PSP image file. The core issue lies in the software's incorrect calculation of buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory. This affects the GIMP application, particularly the gimp package on Red Hat Enterprise Linux 9, as confirmed by Red Hat. Defenders should prioritize patching GIMP to mitigate the risk of successful exploitation, which could lead to complete system compromise or disruption.

Attack Chain

An attacker crafts a malicious Paint Shop Pro (PSP) image file specifically designed to exploit CVE-2026-58379, incorporating malformed low bit-depth image data.
The attacker delivers the specially crafted PSP file to a target user, often via social engineering tactics such as email attachments or malicious download links.
The unsuspecting user is tricked into opening the malicious PSP image file using the GIMP application on their system.
GIMP's internal PSP file format parser attempts to process the malformed image data within the file.
During the parsing of low bit-depth image data, GIMP incorrectly calculates buffer sizes for memory allocation, leading to a heap buffer overflow condition.
This overflow allows attacker-controlled data to overwrite adjacent memory regions within the GIMP process.
Successful exploitation of the memory corruption leads to either arbitrary code execution within the context of the GIMP process or a denial of service, crashing the application.
With arbitrary code execution, the attacker can establish persistence, exfiltrate data, or further compromise the compromised system.

Impact

The successful exploitation of CVE-2026-58379 can lead to significant consequences, ranging from a denial of service (DoS) that crashes the GIMP application, disrupting user workflow, to arbitrary code execution. Arbitrary code execution would allow an attacker to run malicious code within the context of the affected user, potentially leading to full system compromise, data exfiltration, or the installation of additional malware. While specific victim counts or targeted sectors are not detailed, any user of the vulnerable GIMP version, particularly on Red Hat Enterprise Linux 9, is at risk.

Recommendation

Immediately update GIMP to a patched version that addresses CVE-2026-58379. Consult Red Hat advisories (e.g., https://access.redhat.com/security/cve/CVE-2026-58379) for specific package updates for Red Hat Enterprise Linux 9.
Educate users about the risks of opening unsolicited or suspicious image files, especially those from untrusted sources, to mitigate the initial access vector associated with opening specially crafted PSP files.