Description

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-28T20:20:21.527Z",
  "pubdate": "2026-08-28T20:20:21.527Z",
  "executiveSummary": "A memory corruption vulnerability exists within the file-psd plugin of GIMP, stemming from improper validation of the channel-count parameter during the parsing of PSD image files.\nThe flaw triggers heap-based out-of-bounds reads and stack-based out-of-bounds memory accesses.\nSuccessful exploitation allows a remote attacker to induce an application crash, resulting in a Denial of Service (DoS), or potentially achieve limited information disclosure of memory contents.\nThis vulnerability affects users processing untrusted or maliciously crafted PSD files.\nThe risk is primarily categorized as an integrity and availability issue, as the flaw compromises memory safety during file processing.\nNo specific authentication or elevated privileges are required to initiate the attack; however, the attacker must entice a user to open a specially crafted PSD file within the GIMP environment.\nExploitation is typically achieved via file-based vectors, necessitating user interaction.",
  "technicalDetails": "The vulnerability resides in the file-psd plugin of GIMP, specifically within the logic responsible for parsing the PSD (Photoshop Document) file format.\nThe root cause is a failure to perform adequate input validation on the 'channel-count' parameter contained within the image metadata.\nWhen a specially crafted PSD file defines an anomalous or out-of-range value for the number of channels, the plugin proceeds with memory allocation or indexing operations based on this tainted input without enforcing bounds checking.\nThis leads to two distinct memory corruption vectors: first, a heap out-of-bounds read occurs when the plugin attempts to access image data structures allocated based on the attacker-supplied channel count. Second, a stack out-of-bounds access is triggered, potentially overwriting stack frames or reading adjacent stack memory.\nThe attack flow initiates when the target user invokes the GIMP application to open a malicious PSD file. Upon loading, the file-psd plugin extracts the channel-count metadata. Due to the lack of validation, the plugin utilizes this value to calculate offsets or buffer sizes for subsequent image processing operations.\nThe stack out-of-bounds access can lead to unpredictable application behavior, including immediate crashes (DoS), while the heap out-of-bounds read exposes memory contents to the application's processing logic, potentially allowing an attacker to leak sensitive data present in the heap to the user or an external observer.\nThe vulnerability is limited to the file-psd plugin component. It does not require network-level authentication, as the attack vector is local and file-based. However, the reliance on user interaction to process the file limits the automated reach of this vulnerability.\nPost-exploitation impact is primarily concentrated on application availability and confidentiality, specifically the leakage of heap-resident data. No remote code execution (RCE) vector was identified in the provided description, keeping the severity centered on crash-induced denial of service and information disclosure."
}