CVE-2026-58381 is a double-free vulnerability in GIMP's PSP file format parser, specifically in the read_layer_block() function. When a specially crafted PSP file is processed, the double-free condition can corrupt memory, potentially allowing denial of service or arbitrary code execution. Successful exploitation requires local attacker interaction to have a user open the malicious file. The vulnerability affects numerous specific GIMP versions, primarily in the 2.8.x, 2.10.x, and 3.0.x series as enumerated. The vulnerability is rated medium severity with a CVSS 3.1 score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). No official fix or mitigation is currently available according to the Red Hat advisory, which states no mitigation beyond avoiding opening crafted PSP files.

The vulnerability can lead to memory corruption due to a double-free condition, which may cause denial of service or enable arbitrary code execution. Exploitation requires local attacker privileges and user interaction (opening a crafted PSP file). Confidentiality, integrity, and availability impacts are all rated high in the CVSS vector, reflecting the potential for significant damage if exploited.

No official fix or mitigation is currently available. The vulnerability requires opening a specially crafted PSP file to be exploited. Users should avoid opening untrusted PSP files with GIMP until a patch is released. Monitor vendor advisories for updates on remediation.