Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-112257

CVE-2026-112257: GIMP PSD Thumbnail RCE Vulnerability

CVE-2026-112257 is a remote code execution flaw in GIMP affecting PSD thumbnail processing that allows attackers to execute arbitrary code. This post explains its impact, affected versions, and mitigation steps.

Published:

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Sources: National Vulnerability Database, CISA KEV, Exploit-DB

CVE-2026-112257 Overview

CVE-2026-112257 is a heap-based memory corruption flaw in the GNU Image Manipulation Program (GIMP) PSD thumbnail resource loader. The plug-in performs a BGR-to-RGB channel swap using a fixed 3-byte stride and fails to verify that the embedded JPEG thumbnail is actually RGB. A crafted grayscale PSD thumbnail triggers an out-of-bounds read and write in the plug-in process. Exploitation requires a user to browse or open the malicious file, enabling a crash or arbitrary code execution in the context of the GIMP process.

Critical Impact

A single malicious PSD file can corrupt heap memory in GIMP's plug-in process, leading to code execution with the privileges of the user opening the file.

Affected Products

  • GNU Image Manipulation Program (GIMP) PSD plug-in
  • Linux distributions shipping affected GIMP packages (see Red Hat advisory)
  • Any downstream software bundling the vulnerable PSD thumbnail loader

Discovery Timeline

  • 2026-10-19 - CVE-2026-112257 published to the National Vulnerability Database (NVD)
  • 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-112257

Vulnerability Analysis

The flaw resides in GIMP's PSD file format plug-in, specifically in the routine that decodes embedded JPEG thumbnails stored as PSD image resources. The loader assumes every thumbnail is a 3-channel RGB JPEG and performs an in-place BGR-to-RGB channel swap with a hardcoded 3-byte stride.

When a PSD contains a grayscale (1-channel) JPEG thumbnail, the actual pixel buffer size is one third of what the swap routine expects. The loop walks past the end of the allocated buffer, reading and writing out of bounds on the heap. This condition is tracked as a stack-based buffer overflow category weakness [CWE-121] in NVD, though the practical effect is heap corruption inside the plug-in process.

Root Cause

The root cause is missing input validation on the JPEG thumbnail color model. The loader does not inspect the JPEG decoder's output channel count before applying the fixed-stride channel swap. The assumption that channels == 3 is encoded implicitly in the stride constant rather than enforced through a runtime check.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted .psd file through email, a web download, or a shared file system. When the victim opens the file in GIMP, or when a file manager invokes GIMP's thumbnailer to render a preview, the vulnerable code path executes. Successful heap grooming can convert the out-of-bounds write into arbitrary code execution in the user's session.

No verified public exploit code is available at the time of writing. See the Red Hat CVE-2026-112257 advisory and Red Hat Bug Report #2555574 for upstream technical details.

Stop Remote Code Execution Before It Runs

Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.

Stop Exploit Attempts

Detection Methods for CVE-2026-112257

Indicators of Compromise

  • Unexpected GIMP plug-in crashes (file-psd) when browsing directories containing untrusted images
  • Core dumps or segmentation faults originating from the PSD plug-in process
  • PSD files with embedded grayscale JPEG thumbnails arriving from external sources

Detection Strategies

  • Monitor for abnormal child processes spawned by gimp or gimp-plug-in binaries after opening image files
  • Alert on heap corruption signatures (SIGSEGV, SIGABRT) in GIMP processes correlated with recent PSD file access
  • Inspect PSD files statically for a 0x0409 or 0x040C image resource block containing a non-RGB JPEG

Monitoring Recommendations

  • Enable AddressSanitizer (ASan) builds of GIMP in test environments to surface out-of-bounds access during triage
  • Collect endpoint process telemetry for user-initiated image-viewing workflows
  • Track package versions of GIMP across the fleet to confirm patch coverage

How to Mitigate CVE-2026-112257

Immediate Actions Required

  • Apply vendor-supplied GIMP updates from your Linux distribution as soon as they are available
  • Instruct users not to open PSD files from untrusted sources until patches are deployed
  • Disable automatic image thumbnailing in file managers that invoke GIMP as a fallback renderer

Patch Information

At publication, consult the Red Hat CVE-2026-112257 advisory and Red Hat Bug Report #2555574 for fixed package versions. Downstream distributions will ship patched GIMP builds that validate the JPEG thumbnail channel count before performing the BGR-to-RGB swap.

Workarounds

  • Remove or rename the file-psd plug-in to prevent GIMP from loading PSD files until the patch is applied
  • Run GIMP inside a sandbox such as Flatpak or Firejail to constrain the impact of plug-in process compromise
  • Strip embedded thumbnails from inbound PSD files at the mail or file gateway using a trusted image processing utility

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Sources: National Vulnerability Database, CISA KEV, Exploit-DB

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne