CVE-2026-92248 is a vulnerability in the GIMP file-psd plugin where an integer overflow during thumbnail preview generation of a crafted PSD file causes an undersized heap allocation. This results in a heap-based buffer overflow when decoding image data, corrupting adjacent heap objects and enabling controlled memory writes. The flaw is triggered automatically when the GIMP file chooser previews PSD files, without needing to open them. Exploitation requires local user interaction and can lead to application crashes or arbitrary code execution. Red Hat's advisory highlights the role of default security mitigations in reducing exploitability and recommends avoiding untrusted PSD directories and disabling thumbnail previews as mitigations.

The vulnerability allows local attackers to cause application crashes or potentially execute arbitrary code by exploiting a heap-based buffer overflow triggered during thumbnail generation of PSD files. The attack vector is local with user interaction required. Default security mechanisms such as SELinux enforcement, ASLR, and NX stack protection significantly reduce the likelihood of successful arbitrary code execution. The impact includes high confidentiality, integrity, and availability consequences if exploited.

Red Hat advises users to avoid navigating to directories containing PSD files from untrusted sources using the GIMP file chooser. Additionally, users can disable thumbnail generation in GIMP preferences to prevent the vulnerable code path from being executed. These mitigations reduce exposure until an official fix is available. Patch status is not confirmed in the provided data; check the vendor advisory for updates.