CVE-2026-58384 is an integer overflow vulnerability in the read_RLE_channel() function of GIMP's PSD parser on Red Hat Enterprise Linux 9. The overflow causes an undersized heap allocation for the RLE row-length table, which leads to heap memory corruption during subsequent writes. This memory corruption can potentially be exploited to cause denial of service or arbitrary code execution. Red Hat has published an important security advisory (RHSA-2026:40751) that includes a patch updating GIMP to version 3.0.4-4.el9_8.7, which fixes this vulnerability across multiple RHEL 9 variants and architectures.

Successful exploitation of this vulnerability can lead to memory corruption, which may result in denial of service or arbitrary code execution with the privileges of the user running GIMP. The CVSS v3.1 base score is 7.3 (high severity), indicating significant confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported at this time.

Red Hat has released security updates for GIMP in Red Hat Enterprise Linux 9 to address this vulnerability. Users should apply the updated GIMP packages (e.g., gimp-3.0.4-4.el9_8.7) available via Red Hat's official repositories and advisories (RHSA-2026:40751). Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigation steps are indicated by the vendor advisory.