Bug 2555575

Summary: CVE-2026-112257 gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) [fedora-43]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: gimpAssignee: Nils Philippsen <nils>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: 43CC: jridky, nils, phracek, zdohnal
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["079f5b49-accc-4a1a-99a8-b8f5cb4d12c7"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2555574    

Description Srikanth Balasubramanian 2026-10-19 13:38:14 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in the GIMP PSD plug-in thumbnail loader. When a PSD embeds a grayscale JPEG thumbnail, the BGR-to-RGB swap in load_resource_1033() uses a hard-coded 3-byte stride without checking the JPEG component count, reading and writing past the heap buffer. The overflow length is controlled by the file. This can be triggered during thumbnail generation in the file chooser, without fully opening the image. This is distinct from CVE-2026-92248 (thumbnail allocation integer overflow).