CVE-2026-18301

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability within the read_channel_data function during PSD (Photoshop Document) file parsing by enticing a user to open a specially crafted PSD file. This could lead to arbitrary code execution in the context of the current process.

This vulnerability is rated as Important severity for Red Hat because successful exploitation grants arbitrary code execution within the privileges of the active user, justifying a higher severity despite requiring user interaction to open a compromised file. GIMP is an optional desktop application not installed or enabled by default in standard Red Hat Enterprise Linux server environments. Consequently, headless systems and standard server installations are not exposed unless workstation packages have been explicitly installed and utilized to process untrusted graphics.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid opening untrusted or suspicious PSD files with GIMP. As GIMP is a desktop application that processes untrusted content, exercising caution with the origin of files is a primary defense. No specific configuration or operational controls are available to prevent exploitation without patching.