CVE-2026-58379 Gimp: gimp: heap buffer overflow in read_channel_data()
A heap buffer overflow in GIMP's PSP parser allows remote attackers to execute arbitrary code or cause denial of service via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-58379?
CVE-2026-58379 is a high-severity memory corruption vulnerability in Gimp Gimp, published on 3 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.
Weakness: CWE-122
Which versions are affected by CVE-2026-58379?
It affects 4 products.
Linux distribution packages (8)
gimp AlmaLinux:9 | All versions | 2:3.0.4-4.el9_8.5 |
gimp-libs AlmaLinux:9 | All versions | 2:3.0.4-4.el9_8.5 |
gimp Red Hat:enterprise_linux:9::appstream | All versions | 2:3.0.4-4.el9_8.5 |
gimp-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:3.0.4-4.el9_8.5 |
gimp-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:3.0.4-4.el9_8.5 |
gimp-devel-tools-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:3.0.4-4.el9_8.5 |
gimp-libs Red Hat:enterprise_linux:9::appstream | All versions | 2:3.0.4-4.el9_8.5 |
gimp-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:3.0.4-4.el9_8.5 |
Products include Gimp Gimp, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Update Services for Sap Solutions.
How do I fix CVE-2026-58379?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-58379 being exploited?
There is no known exploitation of CVE-2026-58379 in the wild and no public exploit code.
Other vulnerabilities in Gimp Gimp
Sources
Also known as ALSA-2026:38496, CLSA-2026-1784134559, CLSA-2026-1784136022, DEBIAN-CVE-2026-58379, GHSA-rx3j-28q8-xw3m, RHSA-2026:38496 and 1 more.