CVE-2026-82343 - Gimp Vulnerability Details

CVE-2026-82343 - Gimp Vulnerability Details

A flaw, tracked as CVE-2026-82343, was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents. 🚨

The vulnerability was published on August 28, 2026, and is sourced from secalert@redhat.com. Importantly, it is not remotely exploitable. The Common Vulnerability Scoring System (CVSS 3.1) rates this flaw with a MEDIUM severity score of 6.1, with an Exploitability Score of 1.8 and an Impact Score of 4.2.

CVE-2026-82343 is associated with CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’). To address this, organizations should update GIMP and its file-psd plugin to fix memory corruption issues. Specifically, update GIMP to the latest version and apply security patches for the file-psd plugin. Additionally, a preventative measure includes avoiding opening untrusted PSD files. 🔒

The vulnerability is linked to several Common Attack Pattern Enumeration and Classification (CAPEC) entries, which describe common adversary approaches. These include:

• CAPEC-8: Buffer Overflow in an API Call
• CAPEC-9: Buffer Overflow in Local Command-Line Utilities
• CAPEC-10: Buffer Overflow via Environment Variables
• CAPEC-14: Client-side Injection-induced Buffer Overflow
• CAPEC-24: Filter Failure through Buffer Overflow
• CAPEC-42: MIME Conversion
• CAPEC-44: Overflow Binary Resource File
• CAPEC-45: Buffer Overflow via Symbolic Links

For more details, you can read the complete article here.