Log in Start free

Vulnerability · Published Jul 7, 2026 · Assigned by redhat

CVE-2026-58384Gimp: gimp: integer overflow in read_rle_channel()

High 7.3

In plain English

A high-severity integer overflow in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 82.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gimp2:3.0.4-4.el9_8.7ALSA-2026:40751
AlmaLinux:9gimp-libs2:3.0.4-4.el9_8.7ALSA-2026:40751
Debian:12gimpno fix listedDEBIAN-CVE-2026-58384
Debian:13gimp3.0.4-3+deb13u10DEBIAN-CVE-2026-58384
Debian:14gimp3.2.4-1DEBIAN-CVE-2026-58384
Ubuntu:25.10gimpno fix listedUBUNTU-CVE-2026-58384
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-58384

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References