CVE-2026-112257 in GIMP
Summary
by MITRE • 10/20/2026
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within GIMP represents a critical memory safety flaw located specifically within the Portable Software Data PSD thumbnail resource loader component. This issue stems from an improper assumption regarding color space handling during the processing of embedded JPEG thumbnails contained within PSD files. When GIMP attempts to generate or display a preview for a PSD file, it invokes this specific loader routine which is designed to handle RGB image data by performing a channel swap operation that converts BGR formatted pixel data into standard RGB format. The core technical deficiency lies in the fact that this conversion process relies on a fixed three-byte stride calculation without first validating whether the source thumbnail actually conforms to an RGB color model or if it utilizes a different bit depth such as grayscale which typically uses only one byte per pixel rather than three.
This lack of input validation allows for a heap-based out-of-bounds read and write condition when processing maliciously crafted PSD files that contain JPEG thumbnails encoded in grayscale format instead of the expected RGB format. Because the loader blindly applies a three-byte stride logic to data that may not possess sufficient bytes per pixel, it reads beyond the allocated memory buffer boundaries during the channel swap operation. This out-of-bounds read can expose sensitive information from adjacent heap regions while the subsequent write operations corrupt neighboring memory structures. The immediate operational impact of this flaw is typically observed as a crash or segmentation fault within the GIMP plug-in process when a user browses to or opens the affected file, resulting in a denial of service condition for legitimate users relying on thumbnail previews.
However, the severity extends far beyond simple application instability due to the potential for arbitrary code execution. The heap corruption caused by these out-of-bounds writes can be leveraged by an attacker to overwrite function pointers or object vtables within the memory space of the plug-in process. By carefully crafting the grayscale JPEG thumbnail data and potentially chaining this initial vulnerability with other exploitation techniques, a remote attacker could achieve control over program execution flow. This aligns directly with CWE-125 which describes out-of-bounds read vulnerabilities that can lead to information disclosure or crashes, as well as CWE-787 where improper access to memory allows for arbitrary code execution through heap corruption. The attack vector is classified under ATT&CK technique T1046 involving network service enumeration and exploitation via crafted files delivered through social engineering or malicious distribution channels targeting users who open untrusted PSD assets.
Mitigation strategies must address both the immediate technical flaw and broader operational security practices. Developers should implement strict validation checks within the thumbnail loader to verify the color space and bit depth of embedded JPEG thumbnails before applying any stride-based channel manipulation logic. Ensuring that memory allocation matches the actual data size required for processing is essential to prevent out-of-bounds access regardless of input format variations. For end users, it is advisable to avoid opening PSD files from untrusted sources until patches are applied by upstream maintainers. Additionally enabling sandboxing mechanisms or running GIMP with restricted privileges can limit the impact if exploitation occurs since the vulnerability resides in a separate plug-in process rather than the main application binary reducing the potential scope of compromise even though full system control remains possible through privilege escalation techniques following initial code execution.