CVE-2026-92248

HIGH 7.8

Gimp: integer overflow when generating a thumbnail preview for a psd file

CVSS Score

7.8

EPSS Score

0.2%

EPSS Percentile

8th

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

CWE	CWE-190
Vendor	gnome
Product	gimp
Published	Sep 15, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for gnome gimp

Be the first to know when new high vulnerabilities affecting gnome gimp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

GNOME / GIMP

All versions affected

Red Hat / Red Hat Enterprise Linux 8

All versions affected

Red Hat / Red Hat Enterprise Linux 9

All versions affected

Red Hat / Red Hat Enterprise Linux 10

All versions affected

Red Hat / Red Hat Enterprise Linux 6

All versions affected

Red Hat / Red Hat Enterprise Linux 7

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHSA-2026:75575 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:84744 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-92248 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2534282 gitlab.gnome.org: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16775

Credits

Red Hat would like to thank Tan Inn Fung (GovTech Cybersecurity Group) for reporting this issue.