CVE-2026-112257

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

This Important flaw affects the PSD plug-in thumbnail path. Exploitation requires user interaction (browsing a folder with a crafted PSD in GIMP’s file dialog, or opening the file). Red Hat rates this Important.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid opening or browsing untrusted PSD files in GIMP. If GIMP is unused, remove the gimp package.