CVE-2026-90949

A heap-based buffer overflow (CWE-787) exists in GIMP's Paint Shop Pro (PSP) file loader: when the loader processes a compressed selection channel, the allocated buffer is smaller than the amount of data decompressed into it, enabling out-of-bounds writes. An attacker exploits this by crafting a malicious PSP file and convincing a victim to open it in GIMP, so the attack requires user interaction and social engineering rather than unauthenticated remote access. Successful exploitation can crash the application or achieve arbitrary code execution with the privileges of the user running GIMP. Any user who opens untrusted PSP files in GIMP is potentially affected, though the advisory does not state a specific affected or fixed version range. No public proof-of-concept exists, no exploitation in the wild has been observed, and the flaw is not on the CISA Known Exploited Vulnerabilities list.

What to do: Do not open PSP files (.psp, .pspimage, or similar) received from untrusted or unknown sources until a patched GIMP build is confirmed. Monitor GIMP's official announcements and your Linux distribution's package channels for a security update referencing CVE-2026-90949 and apply it promptly once available. If third-party PSP files must be processed, open them in an isolated environment such as a sandbox, separate low-privilege account, or virtual machine to limit the blast radius of potential code execution.