Log in Start free

Vulnerability · Published Jul 3, 2026 · Assigned by redhat

CVE-2026-58379Gimp: gimp: heap buffer overflow in read_channel_data()

High 7.3

In plain English

A high-severity heap buffer overflow in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gimp2:3.0.4-4.el9_8.5ALSA-2026:38496
AlmaLinux:9gimp-libs2:3.0.4-4.el9_8.5ALSA-2026:38496
Debian:12gimpno fix listedDEBIAN-CVE-2026-58379
Debian:13gimp3.0.4-3+deb13u10DEBIAN-CVE-2026-58379
Debian:14gimp3.2.6-1DEBIAN-CVE-2026-58379
Ubuntu:25.10gimpno fix listedUBUNTU-CVE-2026-58379
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-58379
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-58379

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References