Description

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-10T13:19:51.573Z",
  "pubdate": "2026-08-10T13:19:51.573Z",
  "executiveSummary": "A critical security flaw has been identified in the GIMP image manipulation software, specifically within its PSD file format plugin. The vulnerability manifests as an unsigned integer underflow affecting the block_rem variable during the parsing of malformed PSD image files. This cryptographic or parsing anomaly induces state confusion within the parser logic, granting an unauthenticated adversary the capability to inject arbitrary data into layer resource blocks. The overarching business and technical impact includes the potential for arbitrary code execution within the security context of the user running the application. Successful exploitation requires the victim to open a specially crafted malicious PSD file, bypassing typical defensive controls through local file parsing vectors. Consequently, compromise of the host system allows attackers to execute arbitrary binaries, manipulate local resources, and potentially escalate privileges depending on the user's operational environment. The risk implication is severe, necessitating immediate remediation, rigorous input validation hardening, and heightened awareness among users regarding untrusted graphical file formats.",
  "technicalDetails": "The vulnerability resides within the GIMP PSD file format parser plugin, specifically handling memory allocation and boundary calculations associated with layer resource blocks. The root cause is an unsigned integer underflow occurring within the block_rem variable. When GIMP processes a maliciously crafted .psd file, the parser reads specific header or chunk length fields that dictate the remaining block size. Due to a lack of rigorous bounds checking and arithmetic validation prior to decrementing or computing offsets, the unsigned integer representation of block_rem wraps around, resulting in an exceptionally large numeric value or an incorrect small allocation size.\nThis integer underflow directly compromises the parser state machine, creating parser confusion regarding the exact structural boundaries of the input file stream. Exploitation occurs step-by-step as follows: First, the attacker crafts a malicious .psd file containing manipulated header fields designed to trigger the unsigned integer underflow in the block_rem variable during parsing. Second, the victim opens the crafted image file using a vulnerable version of GIMP. Third, upon encountering the malformed fields, the PSD plugin calculates an erroneous buffer size or offset due to the underflow condition, leading to out-of-bounds read/write operations or corrupted heap metadata structures during subsequent memory copy routines.\nThis parser confusion allows the attacker to bypass structural constraints and inject arbitrary data directly into memory spaces designated for layer resource blocks. By strategically placing controlled payloads within the data stream, the attacker can overwrite critical function pointers, heap control structures, or stack frames. Ultimately, this memory corruption primitive achieves arbitrary code execution, enabling the injected payload to run under the user's process privileges. The attack vector requires no network exposure or authentication, relying entirely on local user interaction via the opening of the untrusted file. Post-exploitation impact encompasses full system control, unauthorized data access, persistence installation, and lateral movement within the compromised network."
}