CoreCVE
Back

HIGH

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Apr 11, 2026

Description

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28874.

Affected products

Remediation

Red Hat statement

This is an Important vulnerability in GIMP that could lead to arbitrary code execution. The flaw requires user interaction, as an attacker must entice a user to open a specially crafted PSP (PaintShop Pro) file. Red Hat products are affected if GIMP is installed and used to open untrusted PSP files.

Red Hat mitigation

To mitigate this vulnerability, users should avoid opening untrusted PSP (PaintShop Pro) files with GIMP. Restricting the sources of PSP files to only trusted origins can reduce the risk of exploitation.

Weaknesses (3)

CWE-120

Classic Buffer Overflow

CWE-122

CWE-787

Out-of-bounds Write

References (18)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner zdi
Published Apr 11, 2026
Updated Jul 15, 2026
Reserved Mar 13, 2026
Link CVE-2026-4153
CISA Vulnrichment
Updated Apr 13, 2026
NVD
Status Modified
Modified Jul 15, 2026
Link CVE-2026-4153
Red Hat
Severity Important
Public date Apr 11, 2026
Links CVE-2026-4153 - Bugzilla
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a