CVE-2026-92248

Gimp: integer overflow when generating a thumbnail preview for a psd file

No known exploitation. EPSS puts it in the 10th percentile. Only a workaround so far.

CVSS 3.17.8High EPSS percentile10th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixWorkaroundNo fixed build yet

Published 2026-09-15Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Steps

Written by AI from the record

Check whether you use GIMP to open PSD files (including receiving PSDs by email or downloads).
If you receive PSDs from untrusted sources, stop opening them in GIMP until a fix is available.
If you must preview PSDs, use a safer workflow (open the file in a non-executing preview tool or treat it as untrusted and avoid thumbnail generation when possible).
Watch for an official GIMP update for CVE-2026-92248 and apply it as soon as it’s released.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

In plain language

Written by AI from the record

CVE-2026-92248 is a GIMP bug where opening a specially crafted Photoshop (PSD) file can crash the program or potentially let an attacker run code on your computer; this only matters if you open PSD files in GIMP, and there’s no confirmed patch yet.

CVE-2026-92248 is an integer overflow (CWE-190) in GIMP’s PSD handling when generating a thumbnail preview for a crafted PSD; it can lead to a heap memory overwrite and enable crash or arbitrary code execution upon a victim opening the file.

If you're affected

Device crash during file preview
Potential code execution on workstation
Loss of work or disrupted operations
Malicious files spreading via email

What is it

GIMP has a problem when it tries to show a “preview thumbnail” for certain PSD files. If someone sends you a specially made PSD, GIMP may miscalculate how much memory it needs and accidentally overwrite memory. That can lead to a crash, and in the worst case, it may let an attacker run code on your computer.

Who is affected

This matters if your business runs GIMP on desktops or workstations and employees open PSD files in it (for example, files received from customers, partners, or email). The risk requires a user to open the specially crafted PSD so GIMP begins thumbnail generation. There’s no fix information available yet, and it’s only a risk when the vulnerable file-handling path is reached (i.e., opening a crafted PSD in GIMP that triggers thumbnail preview generation).

How urgent is it

This is AMBER because attackers don’t need special access beyond getting a user to open a crafted PSD file, which is a realistic workplace scenario (email attachments and downloads). There’s no patch information available yet, and the impact includes potential code execution, so you should reduce exposure immediately by limiting PSD opening from untrusted sources.

What to do — in detail

Confirm exposure

Identify which systems have GIMP installed and where PSD files are opened (desktop accounts, design teams, shared machines).
Confirm whether the affected workflow is used: opening PSD files in GIMP such that it generates thumbnail previews.

Determine whether you’re affected

If you can’t determine exact GIMP version, treat all GIMP installations that open PSDs as potentially affected until an official statement or fixed build is published.

Remediation / upgrade

No fixed version or patch package is available in the information we received, so you can’t safely “patch now” based on a version number.
When GIMP (and any Red Hat packaging) releases an update for CVE-2026-92248, upgrade those systems promptly.

Interim workaround (until fixed)

Do not open PSD files from unknown or untrusted sources in GIMP.
If PSDs must be handled, consider routing them through a controlled process (for example, opening them only on a hardened machine dedicated to file review, with limited user privileges) and avoid previews/thumbnail generation for untrusted inputs where feasible.

What to monitor

Look for repeated GIMP crashes shortly after opening PSD files.
Track incoming PSD files from external sources and enforce “trusted sender only” handling until a fix is available.

Technical context

Severity is high (CVSS 7.8), and the finding indicates a local attack path: an attacker must get a user to open a specially crafted PSD file in GIMP, which triggers thumbnail preview generation. The weakness is an integer overflow (CWE-190) during multiplication of values taken from an embedded JPEG header, causing an undersized heap allocation and a heap-based buffer overflow during image decoding. This can corrupt adjacent heap objects; depending on heap layout, it may allow a controlled memory write leading to an application crash or arbitrary code execution. KEV listing is not provided, and no public exploit code is on record in the findings. Press attention exists, but the findings do not confirm exploitation in the wild. No patch/fixed version information is available from the provided sources, so mitigation currently relies on reducing exposure to untrusted PSD inputs and applying the official update once released.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS10th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 10th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 2 days, from the signal feeds we watch.

2026-09-17Workaround availablerecord updated
2026-09-16Workaround availableworkaround available, record updated, record updated
2026-09-15Workaround availablepublished, weakness classified, att&ck mapped, record updated

Affected products

GNOMEoss-project · USaka gnome project, glib
- GIMPOn-premConsumer Software / productivity
Red Hatcommercial · US
- Red Hat Enterprise Linux 10OSOn-premOperating Systems / linux-distro

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable