CVE-2026-2271

A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() function by providing a specially crafted PSP image file. This vulnerability occurs when a 32-bit length value from the file is used for memory allocation without proper validation, leading to a heap overflow and an out-of-bounds write. Successful exploitation could result in an application level denial of service.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-2271	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2438429	Exploit Issue Tracking Vendor Advisory
https://gitlab.gnome.org/GNOME/gimp/-/issues/15732	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:gimp:gimp:3.2.0:rc2:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-26 21:17

Updated : 2026-06-17 10:30

NVD link : CVE-2026-2271

Mitre link : CVE-2026-2271

CVE.ORG link : CVE-2026-2271

JSON object : View

Products Affected

gimp

gimp

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-2271", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2271", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T19:52:36.619548Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "gimp:2.8/gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "gimp", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-03-26T21:17:04.713", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-2271", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438429", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/gimp/-/issues/15732", "tags": ["Exploit", "Issue Tracking"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() function by providing a specially crafted PSP image file. This vulnerability occurs when a 32-bit length value from the file is used for memory allocation without proper validation, leading to a heap overflow and an out-of-bounds write. Successful exploitation could result in an application level denial of service."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el analizador de archivos PSP (Paint Shop Pro) de GIMP. Un atacante remoto podr\u00eda explotar una vulnerabilidad de desbordamiento de entero en la funci\u00f3n read_creator_block() al proporcionar un archivo de imagen PSP especialmente dise\u00f1ado. Esta vulnerabilidad ocurre cuando un valor de longitud de 32 bits del archivo se utiliza para la asignaci\u00f3n de memoria sin una validaci\u00f3n adecuada, lo que lleva a un desbordamiento de mont\u00edculo y una escritura fuera de l\u00edmites. La explotaci\u00f3n exitosa podr\u00eda resultar en una denegaci\u00f3n de servicio a nivel de aplicaci\u00f3n."}], "lastModified": "2026-06-17T10:30:41.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gimp:gimp:3.2.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2585D713-54B3-494C-99DC-53E3A7CE0CFE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}