CVE-2026-82343: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in GNOME GIMP

CVE-2026-82343 is a buffer overflow vulnerability in the file-psd plugin of GIMP. The flaw arises from improper validation of the channel-count parameter in PSD image files, resulting in both heap out-of-bounds reads and stack out-of-bounds accesses. This can cause the application to crash, leading to denial of service, or may allow limited disclosure of memory contents. The vulnerability requires local user interaction to open a crafted PSD file. The CVSS 3.1 base score is 6.1 (medium severity) with an attack vector of local, low attack complexity, no privileges required, and user interaction required. No official patch or fix is currently confirmed in the vendor advisory. The recommended mitigation is to avoid opening PSD files from untrusted sources.

The vulnerability can cause GIMP to crash, resulting in denial of service. Additionally, it may allow limited disclosure of memory contents due to out-of-bounds memory reads. There is no indication of integrity impact or remote exploitation without user interaction. The attack requires a user to open a malicious PSD file, which limits the attack vector to local user interaction.

According to the vendor advisory, no official fix or patch is currently confirmed. The recommended mitigation is to avoid opening PSD files from untrusted or unknown sources in GIMP. Users should exercise caution and only open PSD files from trusted origins until a patch is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.