REDHAT-BUG-2495997: Buffer Overflow
A heap buffer overflow write vulnerability exists in GIMP's Paint Shop Pro (PSP) file format parser. In readchanneldata() in file-psp.c, for low bit-depth images (depth=1 or 4), linewidth uses a packed formula (8 pixels/byte) but fread() reads width bytes (1 byte/pixel). For example, with width=33 and depth=1: allocates 4 bytes, writes 33 — a 29-byte heap overflow.
This is a variant of CVE-2026-4153 (commit 98cb1371), which fixed readlayerblock() but left the buf allocation in readchanneldata() unpatched.
- Function: readchanneldata() - File: plug-ins/common/file-psp.c:1558-1784 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167 - Hardening: https://gitlab.gnome.org/GNOME/gimp/-/commit/20b00d6d - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16205 - Acknowledgment: bb1abu
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2495997?
The severity of REDHAT-BUG-2495997 is rated high with a score of 7.
How do I fix REDHAT-BUG-2495997?
To fix REDHAT-BUG-2495997, update GIMP to the latest version that addresses this heap buffer overflow vulnerability.
What is the impact of REDHAT-BUG-2495997?
The impact of REDHAT-BUG-2495997 could allow an attacker to execute arbitrary code through crafted PSP files.
Where in the code does REDHAT-BUG-2495997 occur?
REDHAT-BUG-2495997 occurs in the read_channel_data() function within file-psp.c.
What type of vulnerability is REDHAT-BUG-2495997?
REDHAT-BUG-2495997 is categorized as a buffer overflow vulnerability.