A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. (CVE-2026-90949)

CVE-2026-90949 describes a heap-based buffer overflow in GIMP's PSP file loader component. The vulnerability occurs during the processing of compressed selection channels due to improper buffer size allocation relative to decompressed data. This flaw allows a remote attacker to craft a malicious PSP file that triggers a crash or arbitrary code execution upon opening in GIMP. The vulnerability affects numerous specific GIMP versions as listed. The CVSS 3.1 base score is 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to a crash of the GIMP application or arbitrary code execution with the privileges of the user running GIMP. This can compromise system confidentiality, integrity, and availability. The attack requires the victim to open a malicious PSP file locally, as the attack vector is local with user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted PSP files in GIMP. Monitor vendor channels for updates and apply patches promptly once released.