Bug 2457535 (CVE-2026-4150)

Summary: CVE-2026-4150 GIMP: GIMP: Arbitrary code execution via specially crafted PSD file
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GIMP. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted PSD (Photoshop Document) file. This flaw is due to an integer overflow during the parsing of PSD files, which can lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2457806    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-11 01:01:39 UTC
GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28807.

Comment 2 errata-xmlrpc 2026-05-12 23:44:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:16484 https://access.redhat.com/errata/RHSA-2026:16484

Comment 3 errata-xmlrpc 2026-05-14 11:55:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:17533 https://access.redhat.com/errata/RHSA-2026:17533

Comment 4 errata-xmlrpc 2026-05-19 21:40:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19362 https://access.redhat.com/errata/RHSA-2026:19362

Comment 5 errata-xmlrpc 2026-05-26 02:18:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:20553 https://access.redhat.com/errata/RHSA-2026:20553

Comment 6 errata-xmlrpc 2026-05-26 03:21:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:20552 https://access.redhat.com/errata/RHSA-2026:20552

Comment 7 errata-xmlrpc 2026-05-26 03:22:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:20554 https://access.redhat.com/errata/RHSA-2026:20554

Comment 8 errata-xmlrpc 2026-05-26 08:48:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:20691 https://access.redhat.com/errata/RHSA-2026:20691

Comment 9 errata-xmlrpc 2026-06-15 01:41:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:25899 https://access.redhat.com/errata/RHSA-2026:25899

Comment 10 errata-xmlrpc 2026-06-15 01:57:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:25901 https://access.redhat.com/errata/RHSA-2026:25901

Comment 11 errata-xmlrpc 2026-06-15 01:57:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:25907 https://access.redhat.com/errata/RHSA-2026:25907

Comment 12 errata-xmlrpc 2026-06-16 04:21:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:26168 https://access.redhat.com/errata/RHSA-2026:26168