CVEvulnerability

CVE-2026-112257

7.8 HIGH Published 2026-10-19 Modified 2026-10-20 Official page ↗
Status
Awaiting Analysis
Published
2026-10-19
Last modified
2026-10-20
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-121

Description

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Related

Weakness · CWE (1)

  • CWE-121 Stack-based Buffer Overflow weakness

References