GIMP: Heap out-of-bounds read and write in PSD thumbnail loader
Summary
GIMP's PSD plug-in thumbnail loader does not correctly handle grayscale JPEG thumbnails embedded in PSD files. A crafted PSD file can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution. Exploitation requires that a user browses a folder containing the file in GIMP's file dialog or opens the file.
Affected
- GIMP (PSD plug-in thumbnail loader)
- Red Hat Enterprise Linux 7, 8, 9 and 10 (listed as affected by Red Hat)
- Debian bookworm, trixie, forky and sid (listed as vulnerable)
- NixOS 3.2.6, 3.0.4 and 3.0.8 release branches (listed as affected)
- Ubuntu: status under evaluation
- Unknown: exact affected versions according to the upstream GIMP project
Fixed in
Unknown. No fixed version or vendor patch was identified at the time of research.
Workaround
- Avoid opening or browsing untrusted PSD files in GIMP.
- If GIMP is not used, remove the gimp package.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable no.
- No public proof-of-concept found.
Our recommendation
- Check whether GIMP is installed on systems that handle untrusted PSD files.
- Remove the gimp package where it is not needed.
- Restrict opening PSD files from untrusted sources and avoid browsing such folders in GIMP.
- Install vendor updates as soon as they are available and monitor the Red Hat, Debian and Ubuntu advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-112257 access.redhat.com
- Red Hat Bugzilla 2555574 bugzilla.redhat.com
- Debian Security Tracker: gimp security-tracker.debian.org
- Ubuntu CVE-2026-112257 ubuntu.com
- NixOS nixpkgs issue 577321 github.com
- OpenCVE CVE-2026-112257 app.opencve.io
- VulDB 422547 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:36.
Original description (NVD)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.