CVE-2026-58379 is a heap buffer overflow vulnerability in the read_channel_data() function of GIMP's PSP file format parser on Red Hat Enterprise Linux 9. The vulnerability arises from improper calculation of buffer sizes when handling low bit-depth images, leading to memory overwrite. This can be exploited by tricking a user into opening a malicious PSP image file, resulting in arbitrary code execution or denial of service. Red Hat has issued an important security advisory (RHSA-2026:38496) with updated GIMP packages (version 3.0.4-4.el9_8.5) that fix this issue across various supported architectures including x86_64, ppc64le, and aarch64.

Successful exploitation allows a local attacker with user privileges to cause arbitrary code execution or denial of service by opening a specially crafted PSP image file in GIMP. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at the time of publication.

Red Hat has released an official security update fixing this vulnerability in GIMP version 3.0.4-4.el9_8.5 for Red Hat Enterprise Linux 9. Users should apply the update as described in Red Hat advisory RHSA-2026:38496 and the referenced article https://access.redhat.com/articles/11258 to remediate the issue. No additional mitigations are indicated by the vendor advisory.