GIMP: Four Image Parsing Plugins Flaws Disclosed Together, Causing DoS

Key findings

• Four medium-severity vulnerabilities disclosed together in GIMP image parsing plugins.
• Flaws include heap out-of-bounds reads and stack out-of-bounds accesses in file-psd, file-pvr, file-ico, and file-iff plugins.
• Vulnerabilities stem from improper validation of parameters like channel-count, palette count, and row size.
• Primary impact is denial-of-service due to application crashes from malformed image files.

On August 28, 2026, GIMP users faced a coordinated disclosure of four medium-severity vulnerabilities, all stemming from improper handling of image file parsing within various GIMP plugins. These flaws, disclosed within a four-hour window, primarily lead to heap out-of-bounds reads and stack out-of-bounds accesses, potentially causing application crashes and denial-of-service conditions.

The vulnerabilities affect several file format plugins:

• **file-psd (CVE-2026-82343):** This plugin fails to properly validate the channel-count parameter when processing specially crafted PSD image files. This leads to insufficient memory bounds checking, resulting in both heap out-of-bounds read and stack out-of-bounds access vulnerabilities.

• **file-pvr (CVE-2026-82330):** Within the PVR image file parser, the VQ (compressed) decoder lacks proper memory bounds checking. This oversight allows for a heap out-of-bounds read when processing malicious PVR files, leading to a denial-of-service.

• **file-ico (CVE-2026-82328):** The ICO file plugin exhibits a similar vulnerability where the used_clrs (palette count) parameter is not adequately validated. This improper validation results in a heap out-of-bounds read due to faulty memory bounds checking.

• **file-iff (CVE-2026-82324):** This vulnerability in the IFF/ILBM plugin arises from incorrect validation of the HAM row size and improper handling of zero color planes (nPlanes). These issues create a row size mismatch, bypassing memory bounds checks and leading to a heap out-of-bounds read.

While these vulnerabilities are classified as medium severity and primarily result in denial-of-service, they highlight a pattern of insecure parsing in GIMP's image handling components. Users are advised to update GIMP to the latest version to mitigate these risks. The specific versions patched are not detailed in the disclosures, but it is standard practice for such vulnerabilities to be addressed in subsequent stable releases.

This batch of vulnerabilities underscores the importance of rigorous input validation, especially in components that process external files. For GIMP users, staying updated with the latest software releases is crucial to protect against potential crashes and denial-of-service attacks stemming from malformed image files. The coordinated nature of this disclosure suggests a focused effort to identify and report these types of parsing flaws.