Threats Tagged 'cve-2026-58381'

This security update for GIMP addresses three vulnerabilities: a heap buffer overflow in PSP file parsing (CVE-2026-58379), a buffer overflow in pnmscanner_gettoken (CVE-2026-58380), and a double-free issue with PSP layer names (CVE-2026-58381). These issues could lead to memory corruption and potential instability or exploitation. The update fixes these vulnerabilities to improve the security and stability of GIMP.

A double-free vulnerability exists in GIMP's PSP file format parser within the read_layer_block() function. This flaw can cause memory corruption when processing specially crafted PSP files, potentially leading to denial of service or arbitrary code execution. Exploitation requires a local attacker to convince a user to open a malicious PSP file using GIMP. The vulnerability affects multiple specific GIMP versions as listed. The CVSS v3.1 score is 7.3, indicating a medium severity. No official patch or mitigation is currently provided; the issue requires opening a crafted file to trigger.

A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.