CVE-2026-119528

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.

This Important flaw affects GIMP’s PSD (Photoshop) file import plug-in. Exploitation requires user interaction to open a crafted PSD file (or otherwise cause the PSD plug-in to parse untrusted image resource headers). Successful exploitation can crash the plug-in process and may allow arbitrary code execution in the context of the user running GIMP.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not open untrusted PSD files in GIMP. Avoid browsing directories containing untrusted PSD files in GIMP’s file dialog if thumbnail/preview loading may parse PSD resources. If GIMP is not required, remove the gimp package.