High severity7.8NVD Advisory· Published Sep 15, 2026· Updated Oct 19, 2026
CVE-2026-92248
CVE-2026-92248
Description
A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17- osv-coords16 versionspkg:rpm/almalinux/gimppkg:rpm/almalinux/gimp-develpkg:rpm/almalinux/gimp-devel-toolspkg:rpm/almalinux/gimp-libspkg:rpm/almalinux/pygobject2pkg:rpm/almalinux/pygobject2-codegenpkg:rpm/almalinux/pygobject2-develpkg:rpm/almalinux/pygobject2-docpkg:rpm/almalinux/pygtk2pkg:rpm/almalinux/pygtk2-codegenpkg:rpm/almalinux/pygtk2-develpkg:rpm/almalinux/pygtk2-docpkg:rpm/almalinux/python2-cairopkg:rpm/almalinux/python2-cairo-develpkg:rpm/opensuse/gimp&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/gimp&distro=openSUSE%20Tumbleweed
< 2:3.0.4-4.el9_8.14+ 15 more
- (no CPE)range: < 2:3.0.4-4.el9_8.14
- (no CPE)range: < 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
- (no CPE)range: < 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
- (no CPE)range: < 2:3.0.4-4.el9_8.14
- (no CPE)range: < 2.28.7-5.module_el8.10.0+4267+35168c80
- (no CPE)range: < 2.28.7-5.module_el8.10.0+4267+35168c80
- (no CPE)range: < 2.28.7-5.module_el8.10.0+4267+35168c80
- (no CPE)range: < 2.28.7-5.module_el8.10.0+4267+35168c80
- (no CPE)range: < 2.24.0-25.module_el8.9.0+3725+d1441900
- (no CPE)range: < 2.24.0-25.module_el8.9.0+3725+d1441900
- (no CPE)range: < 2.24.0-25.module_el8.9.0+3725+d1441900
- (no CPE)range: < 2.24.0-25.module_el8.9.0+3725+d1441900
- (no CPE)range: < 1.16.3-7.module_el8.10.0+4267+35168c80
- (no CPE)range: < 1.16.3-7.module_el8.10.0+4267+35168c80
- (no CPE)range: < 3.0.8-bp160.10.1
- (no CPE)range: < 3.2.6-3.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.