CVE-2026-92248 is an integer overflow vulnerability in the file-psd plugin of GIMP on Red Hat Enterprise Linux 10. When generating a thumbnail preview for a crafted PSD file, an integer overflow during multiplication of embedded JPEG header values causes an undersized heap allocation. This leads to a heap-based buffer overflow during image decoding, corrupting adjacent heap objects. The vulnerability can result in application crashes or arbitrary code execution. Exploitation requires local user interaction by navigating to a directory with the malicious PSD file in the GIMP file chooser. Red Hat's default security mechanisms such as SELinux, ASLR, and NX stack protection mitigate exploitation difficulty. No official fix or patch is explicitly stated in the advisory. Mitigation involves avoiding untrusted PSD directories and disabling thumbnail previews.

Successful exploitation can cause application crashes or potentially arbitrary code execution due to heap-based buffer overflow triggered by an integer overflow in thumbnail generation. The vulnerability requires local user interaction and access to a directory containing a malicious PSD file. Default Red Hat Enterprise Linux security features reduce the likelihood of arbitrary code execution, limiting the impact severity.

Red Hat advises users to avoid navigating to directories containing PSD files from untrusted sources using the GIMP file chooser. Additionally, users can disable thumbnail generation in GIMP preferences to prevent the vulnerable code path from executing. No official patch or fix is currently confirmed; users should monitor the Red Hat advisory for updates.