REDHAT-BUG-2496166: Medium severity GIMP GIMP vulnerability
A double-free vulnerability exists in GIMP's Paint Shop Pro (PSP) file format parser. In readlayerblock() in file-psp.c, the variable name is allocated, used, and freed each loop iteration. On the error path in the 2nd iteration, fread fails before gmalloc for name, so the stale pointer from iteration 1 is freed again via gfree(name).
- Function: readlayerblock() - File: plug-ins/common/file-psp.c:1908-2321 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16207 - Acknowledgment: bb1abu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GIMP (plug-ins/common/file-psp.c)to a version that resolves this vulnerability.Patch b22e147b - Compensating control
If you cannot immediately apply the upstream fix (commit b22e147b), mitigate by disabling or restricting opening of Paint Shop Pro (PSP) format files until patched.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2496166?
REDHAT-BUG-2496166 has a medium severity rating of 4.
How do I fix REDHAT-BUG-2496166?
Fixing REDHAT-BUG-2496166 requires updating to the latest version of GIMP where this vulnerability has been addressed.
What does REDHAT-BUG-2496166 impact?
REDHAT-BUG-2496166 impacts the Paint Shop Pro (PSP) file format parser in GIMP.
What type of vulnerability is REDHAT-BUG-2496166?
REDHAT-BUG-2496166 is a double-free vulnerability.
When was REDHAT-BUG-2496166 published?
REDHAT-BUG-2496166 was published on July 1, 2026.