CVE-2026-92248: GIMP file-psd Buffer Overflow Vulnerability

CVE-2026-92248 Overview

A heap-based buffer overflow exists in the file-psd plugin shipped with GIMP. The flaw occurs when GIMP generates a thumbnail preview for a specially crafted Photoshop Document (PSD) file. An integer overflow ([CWE-190]) during multiplication of values sourced from an embedded JPEG header produces an undersized heap allocation. When image data is subsequently decoded into that buffer, adjacent heap objects are corrupted. An attacker can leverage this controlled memory write to crash the application or achieve arbitrary code execution in the context of the user opening the file.

Critical Impact
Opening or previewing a malicious PSD file can lead to arbitrary code execution under the current user account.

Affected Products

GIMP file-psd plugin (PSD image loader)
Linux distributions repackaging affected GIMP builds, including Red Hat
Applications and file managers that invoke GIMP thumbnailers for PSD files

Discovery Timeline

2026-09-15 - CVE-2026-92248 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92248

Vulnerability Analysis

The file-psd plugin parses PSD files that may embed a JPEG-encoded thumbnail preview. During thumbnail generation, the plugin reads width, height, and channel-related fields from the JPEG header and multiplies them to size a destination heap buffer. Because the multiplication is performed without sufficient range validation, attacker-controlled values wrap around the fixed-width integer type. The plugin then requests a heap allocation smaller than the actual decoded pixel data. The JPEG decoder writes the full-sized image into the undersized buffer, overwriting adjacent heap chunks. Because the overflow is driven by values inside the crafted file, attackers can shape the write to corrupt neighboring objects such as function pointers or allocator metadata. User interaction is required, but the interaction can be as minor as browsing a folder that triggers thumbnail generation.

Root Cause

The root cause is an unchecked arithmetic operation classified as [CWE-190] Integer Overflow or Wraparound. The plugin trusts dimension and channel values parsed from the embedded JPEG header without validating that their product fits within the target integer type or the intended buffer size.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted PSD file through email, a shared drive, a download, or any surface that renders thumbnails. When GIMP or a thumbnailer that links against the vulnerable plugin processes the file, the overflow triggers and code executes with the privileges of the invoking user.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-92248 Advisory and the GNOME GIMP Work Item #16775 for upstream analysis.

Detection Methods for CVE-2026-92248

Indicators of Compromise

PSD files with malformed or extreme dimension fields in the embedded JPEG thumbnail resource block.
Unexpected crashes of gimp, gimp-console, or PSD thumbnailer processes with SIGSEGV or heap corruption diagnostics.
Child processes spawned by GIMP or a thumbnailer daemon that are not part of normal image editing workflows.

Detection Strategies

Alert on GIMP or thumbnailer processes launching shells, interpreters, or network utilities such as bash, python, curl, or nc.
Monitor for glibc heap corruption messages (malloc(): corrupted, double free or corruption) in system journals tied to GIMP.
Inspect PSD files at email and web gateways for oversized or inconsistent Image Resource Block 0x040C (thumbnail) fields.

Monitoring Recommendations

Collect endpoint telemetry for process ancestry involving gimp, gnome-thumbnail-factory, and tumblerd.
Forward crash reports from systemd-coredump or abrt to a centralized log store for triage.
Track GIMP package versions across managed hosts to identify systems still running vulnerable builds.

How to Mitigate CVE-2026-92248

Immediate Actions Required

Update GIMP to the fixed version distributed by your operating system vendor as soon as it becomes available.
Disable automatic PSD thumbnail generation in file managers until patches are deployed.
Instruct users not to open PSD files from untrusted sources.

Patch Information

Fix status is tracked upstream in GNOME GIMP Work Item #16775 and in the Red Hat Bug Report #2534282. Apply distribution updates once the patched gimp package is published for your platform. Consult the Red Hat CVE-2026-92248 Advisory for downstream availability.

Workarounds

Remove or rename the file-psd plugin binary to prevent GIMP from loading PSD files until a patched build is installed.
Configure file managers such as Nautilus to skip thumbnail generation for PSD MIME types.
Restrict PSD file delivery through mail and web content filters to reduce exposure.

bash

# Disable thumbnailing for PSD files in GNOME environments
gsettings set org.gnome.desktop.thumbnailers disable "['image/vnd.adobe.photoshop','image/x-psd']"

# Optionally remove the vulnerable plugin (path varies by distribution)
sudo mv /usr/lib64/gimp/2.0/plug-ins/file-psd/file-psd \
        /usr/lib64/gimp/2.0/plug-ins/file-psd/file-psd.disabled