CVE-2026-92248

GIMP's file-psd plugin contains an integer overflow (CWE-190) that occurs when it multiplies values from an embedded JPEG header while generating a thumbnail preview for a specially crafted PSD image. The overflow results in an undersized heap allocation, and subsequent decoding of the image data writes beyond that buffer, corrupting adjacent heap objects. Successful exploitation can crash the application or achieve arbitrary code execution with the privileges of the user running GIMP. Any user who opens a malicious PSD file is affected, since the flaw requires user interaction (opening the file) but no privileges. No public proof-of-concept exists and the issue is not in the CISA KEV catalog, so exploitation status is currently unknown/none known.

What to do: Update GIMP to the latest release from your distribution's package manager or gimp.org as soon as a fixed build is published. Until patched, avoid opening PSD files from untrusted or unknown sources and consider disabling the file-psd plugin if PSD support is not required. On multi-user systems, run GIMP under a non-privileged account to limit the impact of potential code execution.