CVE-2026-58379: Gimp: gimp: heap buffer overflow in read_channel_data()
A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.
Other sources
A heap buffer overflow write vulnerability exists in GIMP's Paint Shop Pro (PSP) file format parser. In readchanneldata() in file-psp.c, for low bit-depth images (depth=1 or 4), linewidth uses a packed formula (8 pixels/byte) but fread() reads width bytes (1 byte/pixel). For example, with width=33 and depth=1: allocates 4 bytes, writes 33 — a 29-byte heap overflow.
This is a variant of CVE-2026-4153 (commit 98cb1371), which fixed readlayerblock() but left the buf allocation in readchanneldata() unpatched.
- Function: readchanneldata() - File: plug-ins/common/file-psp.c:1558-1784 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167 - Hardening: https://gitlab.gnome.org/GNOME/gimp/-/commit/20b00d6d - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16205 - Acknowledgment: bb1abu
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58379?
CVE-2026-58379 has a high severity rating of 7.3.
How do I fix CVE-2026-58379?
To fix CVE-2026-58379, update GIMP to the latest version provided by the developers that addresses this vulnerability.
What type of vulnerability is CVE-2026-58379?
CVE-2026-58379 is classified as a heap buffer overflow vulnerability.
What can an attacker do with CVE-2026-58379?
An attacker can exploit CVE-2026-58379 to execute arbitrary code or cause a denial of service by tricking users into opening a malicious PSP file.
Which software is affected by CVE-2026-58379?
CVE-2026-58379 affects GIMP, specifically its PSP file format parser.