CVE-2026-92248

GIMP has a problem when it tries to show a “preview thumbnail” for certain PSD files. If someone sends you a specially made PSD, GIMP may miscalculate how much memory it needs and accidentally overwrite memory. That can lead to a crash, and in the worst case, it may let an attacker run code on your computer.

This matters if your business runs GIMP on desktops or workstations and employees open PSD files in it (for example, files received from customers, partners, or email). The risk requires a user to open the specially crafted PSD so GIMP begins thumbnail generation. There’s no fix information available yet, and it’s only a risk when the vulnerable file-handling path is reached (i.e., opening a crafted PSD in GIMP that triggers thumbnail preview generation).

This is AMBER because attackers don’t need special access beyond getting a user to open a crafted PSD file, which is a realistic workplace scenario (email attachments and downloads). There’s no patch information available yet, and the impact includes potential code execution, so you should reduce exposure immediately by limiting PSD opening from untrusted sources.

Confirm exposure

• Identify which systems have GIMP installed and where PSD files are opened (desktop accounts, design teams, shared machines).
• Confirm whether the affected workflow is used: opening PSD files in GIMP such that it generates thumbnail previews.

Determine whether you’re affected

• If you can’t determine exact GIMP version, treat all GIMP installations that open PSDs as potentially affected until an official statement or fixed build is published.

Remediation / upgrade

• No fixed version or patch package is available in the information we received, so you can’t safely “patch now” based on a version number.
• When GIMP (and any Red Hat packaging) releases an update for CVE-2026-92248, upgrade those systems promptly.

Interim workaround (until fixed)

• Do not open PSD files from unknown or untrusted sources in GIMP.
• If PSDs must be handled, consider routing them through a controlled process (for example, opening them only on a hardened machine dedicated to file review, with limited user privileges) and avoid previews/thumbnail generation for untrusted inputs where feasible.

What to monitor

• Look for repeated GIMP crashes shortly after opening PSD files.
• Track incoming PSD files from external sources and enforce “trusted sender only” handling until a fix is available.

Severity is high (CVSS 7.8), and the finding indicates a local attack path: an attacker must get a user to open a specially crafted PSD file in GIMP, which triggers thumbnail preview generation. The weakness is an integer overflow (CWE-190) during multiplication of values taken from an embedded JPEG header, causing an undersized heap allocation and a heap-based buffer overflow during image decoding. This can corrupt adjacent heap objects; depending on heap layout, it may allow a controlled memory write leading to an application crash or arbitrary code execution. KEV listing is not provided, and no public exploit code is on record in the findings. Press attention exists, but the findings do not confirm exploitation in the wild. No patch/fixed version information is available from the provided sources, so mitigation currently relies on reducing exposure to untrusted PSD inputs and applying the official update once released.