Bug 2525644 (CVE-2026-82343) - CVE-2026-82343 gimp: heap out-of-bounds read and stack out-of-bounds access in PSD loader from channel-count handling
Summary: CVE-2026-82343 gimp: heap out-of-bounds read and stack out-of-bounds access i...
Keywords:
Status: NEW
Alias: CVE-2026-82343
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2525645
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-28 16:12 UTC by OSIDB Bzimport
Modified: 2026-08-28 16:15 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-28 16:12:27 UTC
A flaw was found in the file-psd plugin in GIMP, affecting all versions. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.


Note You need to log in before you can comment on or make changes to this bug.