CVE-2026-82343: GIMP PSD Plugin DoS Vulnerability

CVE-2026-82343 Overview

A flaw exists in the file-psd plugin bundled with GIMP, the GNU Image Manipulation Program. The plugin fails to properly validate the channel-count parameter when parsing Adobe Photoshop (PSD) image files. Processing a specially crafted PSD triggers a heap out-of-bounds read and a stack out-of-bounds access, classified as a buffer boundary violation [CWE-120]. Exploitation requires a local user to open a malicious file, resulting in an application crash or limited disclosure of process memory contents. Red Hat Enterprise Linux 6, 7, 8, and 9 ship affected GIMP packages.

Critical Impact
An attacker who convinces a user to open a crafted PSD file can crash GIMP or read adjacent memory, causing denial of service or limited information disclosure.

Affected Products

GIMP (file-psd plugin) — all versions prior to the upstream fix
Red Hat Enterprise Linux 6.0, 7.0, 8.0, and 9.0 GIMP packages
Downstream distributions repackaging affected GIMP builds

Discovery Timeline

2026-08-28 - CVE-2026-82343 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database
2026-09-03 - EPSS scoring data published

Technical Details for CVE-2026-82343

Vulnerability Analysis

The vulnerability resides in GIMP's file-psd import plugin, responsible for parsing Adobe PSD image files. PSD headers declare a channel count that informs downstream buffer allocations and iteration bounds inside the plugin. The plugin does not validate that the declared channel count falls within the range supported by the internal parsing routines. When the parser accepts an attacker-controlled value, it performs indexed reads against fixed-size heap buffers and stack arrays without confirming that the index remains within bounds. The result is a heap out-of-bounds read and a stack out-of-bounds access during layer and channel enumeration. GIMP either terminates on the invalid access or exposes bytes from adjacent memory regions to the parsing logic, which can propagate into diagnostic output.

Root Cause

The root cause is missing bounds enforcement on the channel-count field before it is used as a loop and array index. The plugin trusts a value taken directly from untrusted file input, violating standard input validation practice for file-format parsers.

Attack Vector

Exploitation requires local access and user interaction. An attacker must deliver a crafted PSD file to a target user and induce them to open it in GIMP, for example through a phishing lure or a shared document. No elevated privileges are needed. The resulting impact is a process crash or limited exposure of memory contents that happen to be adjacent to the parser's buffers. Refer to the Red Hat CVE-2026-82343 Advisory and the GNOME GIMP Work Item #16587 for upstream analysis.

Detection Methods for CVE-2026-82343

Indicators of Compromise

Unexpected crashes of the gimp process shortly after a user opens a PSD file from email, chat, or an untrusted share.
Core dumps or abrt reports referencing the file-psd plugin binary or psd-load.c call sites.
PSD files sourced from external senders with malformed or unusually large channel-count header fields.

Detection Strategies

Inspect PSD headers at the mail or file gateway and flag files whose declared channel count exceeds the format's expected maximum.
Correlate GIMP process termination events with recent file-open activity to surface probable exploitation attempts.
Enable AddressSanitizer-instrumented builds in test environments to reproduce and confirm the out-of-bounds behavior on suspect samples.

Monitoring Recommendations

Forward endpoint process crash telemetry and Linux coredumpctl events to a centralized log platform for review.
Track invocation of GIMP with PSD file arguments across user endpoints, particularly on workstations handling design assets from external parties.
Monitor package inventory to identify hosts still running unpatched GIMP versions across Red Hat Enterprise Linux 6, 7, 8, and 9.

How to Mitigate CVE-2026-82343

Immediate Actions Required

Apply vendor updates for GIMP on all Red Hat Enterprise Linux hosts once packages become available through the standard channels.
Instruct users to avoid opening PSD files received from untrusted sources until the patch is deployed.
Restrict GIMP execution on servers and shared workstations where image editing is not a required function.

Patch Information

Red Hat is tracking the fix under Red Hat Bug Report #2525644, and the upstream fix is coordinated through GNOME GIMP Work Item #16587. Administrators should update GIMP through dnf or yum once errata are released and verify installed versions with rpm -q gimp.

Workarounds

Disable or remove the file-psd plugin from the GIMP plug-ins directory to prevent the vulnerable code path from loading.
Convert untrusted PSD files to a safer intermediate format such as PNG using a sandboxed converter before opening in GIMP.
Run GIMP inside a restricted sandbox such as firejail or a Flatpak profile that limits filesystem and memory access.

bash

# Locate and disable the vulnerable file-psd plugin
rpm -ql gimp | grep file-psd
sudo mv /usr/lib64/gimp/2.0/plug-ins/file-psd/file-psd \
        /usr/lib64/gimp/2.0/plug-ins/file-psd/file-psd.disabled

# Verify GIMP no longer registers the PSD loader
gimp -c --batch-interpreter=python-fu-eval \
     -b '(gimp-message (car (gimp-version)))' -b '(gimp-quit 0)'