CVE-2026-92248

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description A flaw exists in the file-psd plugin. When the application generates a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This results in an undersized heap allocation, leading to a heap-based buffer overflow during image data decoding. This process corrupts adjacent heap objects, enabling a controlled memory write that may cause an application crash or arbitrary code execution. The issue can be triggered simply by entering a folder where GIMP creates thumbnails, without requiring the user to open the file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the file-psd plugin or avoid loading folders containing untrusted PSD files to minimize the risk of exploitation.