GIMP Vulnerability Allows Remote Code Execution via PSD File Parsing
Zero Day Initiative disclosed a critical integer overflow vulnerability in GIMP's PSD file parsing, enabling remote code execution.
Zero Day Initiative (ZDI) has publicly disclosed a critical vulnerability, identified as ZDI-26-454 and CVE-2026-18301, affecting the popular open-source image editor GIMP. The flaw resides within the software's component responsible for parsing Photoshop Document (PSD) files. This vulnerability, classified as an integer overflow, arises from insufficient validation of user-supplied data during the file parsing process. Attackers can exploit this by crafting a malicious PSD file that, when opened by a user, triggers the overflow. This overflow can lead to an integer overflow before a buffer is allocated, potentially allowing an attacker to execute arbitrary code within the context of the current GIMP process.
The exploitation of this vulnerability requires a degree of user interaction. Specifically, a victim must be tricked into opening a specially crafted PSD file or visiting a malicious webpage that hosts such a file. Once triggered, the vulnerability could allow an attacker to gain control over the affected system, depending on the privileges of the running GIMP process. The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a score of 7.8, indicating a high severity level.
GIMP has already released an update to address this security flaw. The fix was coordinated with ZDI, and details of the patch can be found in the merge request on GitLab. This proactive patching by the GIMP development team is crucial in mitigating the risk posed by this vulnerability. Users are strongly advised to update their GIMP installations to the latest version as soon as possible to protect themselves from potential exploitation.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on April 17, 2026. Following a period of coordinated vulnerability disclosure, ZDI published the advisory on July 29, 2026, the same day the advisory was updated with further details. This coordinated release aims to give users sufficient time to apply patches before the vulnerability becomes widely known and potentially exploited by malicious actors.
This vulnerability is part of a broader trend of security issues discovered in widely used software, particularly those that handle complex file formats. Image editing software like GIMP often parse a variety of file types, each presenting unique challenges for secure parsing. Vulnerabilities in these parsing components can have significant consequences, as demonstrated by this integer overflow flaw that can lead to remote code execution.
The specific nature of the flaw—an integer overflow during buffer allocation—is a common type of vulnerability that can be difficult to detect and prevent. It highlights the ongoing need for rigorous security auditing and secure coding practices, especially in open-source projects that are widely distributed and relied upon by many users. The involvement of Zero Day Initiative in discovering and coordinating the disclosure of such vulnerabilities underscores their importance in the cybersecurity ecosystem.
While the exploitation requires user interaction, the high CVSS score and the potential for arbitrary code execution make this a significant finding. The GIMP project's swift response in issuing a patch is commendable and serves as a reminder for users to maintain up-to-date software. The anonymous researcher who discovered this flaw has been credited by ZDI, contributing to the ongoing effort to improve software security.