CVE-2026-58384: Gimp: gimp: integer overflow in read_rle_channel()
A flaw was found in GIMP's PSD parser. An integer overflow in readRLEchannel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
Other sources
Integer overflow in GIMP's PSD parser. In readRLEchannel() in psd-load.c, the allocation for rlepacklen uses gmalloc (lyrchn->rows 4) with unchecked arithmetic. A crafted PSD can overflow the allocation size calculation and desynchronize it from the subsequent per-row writes, causing heap memory corruption.
- Function: readRLEchannel() - File: plug-ins/file-psd/psd-load.c:1843-1865 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217 - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16216 - Acknowledgment: bb1abu
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58384?
CVE-2026-58384 has a high severity rating of 7.8.
What components are affected by CVE-2026-58384?
CVE-2026-58384 affects GIMP and Red Hat Enterprise Linux.
How do I fix CVE-2026-58384?
To fix CVE-2026-58384, update GIMP to the latest patched version available.
What type of vulnerability is CVE-2026-58384?
CVE-2026-58384 is classified as an integer overflow vulnerability.
What are the potential impacts of CVE-2026-58384?
CVE-2026-58384 can lead to memory corruption, resulting in denial of service or arbitrary code execution.