Description

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-14T14:17:20.840Z",
  "pubdate": "2026-09-14T14:17:20.840Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists within the GIMP Paint Shop Pro (PSP) file format loader. The flaw originates from an improper handling of compressed selection channels during the image parsing process. By supplying a specially crafted PSP file, a remote attacker can trigger a memory corruption event when the file is processed by GIMP. This vulnerability poses a significant risk as it may lead to application instability or arbitrary code execution within the context of the user running the application. No specific authentication or elevated privileges are required for exploitation, as the attack is triggered simply by the victim opening a malicious file. Successful exploitation allows for unauthorized code execution, potentially leading to a full system compromise, data theft, or malware installation. The reliance on complex decompression routines makes this a high-impact flaw for any user processing untrusted PSP imagery.",
  "technicalDetails": "The vulnerability resides in the GIMP PSP loader component responsible for parsing and decompressing selection channel data. During the decompression phase of a PSP file, the application allocates a heap buffer intended to store the resulting pixel or selection data. The root cause of the flaw is an insufficient validation of the relationship between the allocated heap memory size and the actual volume of data generated by the decompression algorithm. Specifically, the parser fails to properly synchronize the expected decompression output with the physical boundaries of the allocated buffer, leading to an out-of-bounds write operation.\nThe attack flow initiates when an attacker distributes a malformed PSP file containing a manipulated selection channel. When GIMP attempts to load this file, the decompression routine is invoked. The attacker crafts the file such that the decompression algorithm interprets instructions leading to a buffer overflow on the heap. Because the target is heap memory, an attacker may leverage techniques such as heap grooming or spraying to overwrite adjacent memory structures, such as object pointers, function pointers, or application-specific metadata. By carefully crafting the overflow payload, the attacker can hijack the application's control flow.\nThe exploitation process follows these steps: first, the attacker prepares a malicious PSP file with an obfuscated selection channel block that triggers a decompression routine resulting in output exceeding the buffer size. Second, the GIMP user opens the file, triggering the vulnerable loader. Third, the overflow occurs, overwriting heap memory. Fourth, the attacker redirects execution by corrupting a sensitive memory address, leading to the execution of arbitrary shellcode or a return-oriented programming (ROP) chain. This process bypasses standard application-level controls and executes with the privileges of the authenticated user. The vulnerability is characterized as a remote code execution vector because it relies solely on the user performing the common action of opening an image file. The lack of robust bounds checking within the decompression logic remains the primary technical failure, facilitating a direct path from malformed input to controlled memory corruption."
}