GIMP Vulnerability Allows Remote Code Execution via Malicious PSP Files
Zero Day Initiative has disclosed a critical remote code execution vulnerability in GIMP, stemming from an integer overflow in its PSP file parsing component.
The popular open-source image editor GIMP is affected by a critical vulnerability that could allow remote attackers to execute arbitrary code on a user's system. The flaw, detailed by the Zero Day Initiative (ZDI) and assigned CVE-2026-4153, resides within the software's handling of PSP (Photoshop large document format) files.
Specifically, the vulnerability arises from an integer overflow condition that occurs during the parsing of PSP files. This overflow happens due to a lack of proper validation of user-supplied data before memory is allocated. An attacker can exploit this by crafting a malicious PSP file that, when opened by a GIMP user, triggers the overflow. This can lead to the execution of code within the context of the current GIMP process.
Exploitation of this vulnerability requires a degree of user interaction. Attackers would need to trick a victim into opening a specially crafted malicious PSP file. Alternatively, if GIMP is used in a context where it might automatically process files from a compromised webpage or source, that could also serve as an attack vector. The CVSS score for this vulnerability is rated at 7.8, indicating a high severity.
While the vulnerability allows for code execution, it is constrained to the privileges of the GIMP process itself. However, this is often sufficient for attackers to deploy further malware, steal sensitive information accessible by the user running GIMP, or use the compromised system as a pivot point into a larger network.
The GIMP development team, in coordination with ZDI, has already released an update to address this security flaw. The fix involves correcting the input validation within the PSP file parsing component to prevent the integer overflow. Users are strongly advised to update their GIMP installations to the latest available version as soon as possible to mitigate this risk.
This disclosure highlights the ongoing challenges in securing complex software, particularly those with extensive file format support. Vulnerabilities in parsing components are a common attack vector, as they often involve intricate logic and edge cases that can be difficult to secure comprehensively. The prompt patching by the GIMP team, following ZDI's coordinated disclosure, is a positive sign for user security.
This vulnerability was reported to the vendor on April 17, 2026, and was publicly disclosed on September 9, 2026, following a coordinated disclosure timeline. The vulnerability was reported by an anonymous researcher. The advisory was updated on the same day as its initial release.