CVE-2026-82343: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in GNOME GIMP

CVE-2026-82343 is a buffer overflow vulnerability in the file-psd plugin of GNOME GIMP. The plugin fails to properly validate the channel-count parameter in PSD files, resulting in improper memory bounds checking. This causes both heap out-of-bounds reads and stack out-of-bounds accesses. The flaw can lead to application crashes causing denial of service or limited memory information disclosure. Exploitation requires convincing a user to open a crafted PSD file locally. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) with local attack vector, low complexity, no privileges required, and user interaction needed. The vendor advisory from Red Hat does not confirm availability of a patch but recommends avoiding untrusted PSD files as mitigation.

The vulnerability can cause denial of service via application crashes and limited disclosure of memory contents when processing malicious PSD files. It requires local user interaction to open a crafted file, which reduces exploitation likelihood. There is no indication of remote exploitation or privilege escalation. The confidentiality impact is low, integrity impact is none, and availability impact is high according to the CVSS vector.

No official patch or fix status is confirmed in the vendor advisory. The recommended mitigation is to avoid opening PSD files from untrusted or unknown sources with GIMP. Users should exercise caution with PSD files to prevent triggering the vulnerability.