Fluid Attacks Database

Description

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	gimp	=3.0.4-3 \|\| =3.0.4-4 \|\| =3.0.4-5 \|\| =3.0.4-6 \|\| =3.0.4-6.1 \|\| =3.0.4-6.2 \|\| =3.0.6-1 \|\| =3.2.0-1 \|\| =3.2.0~rc2-1 \|\| =3.2.0~rc2-2 \|\| =3.2.0~rc2-3 \|\| =3.2.0~rc2-3.1 \|\| =3.2.0~rc2-3.2 \|\| =3.2.0~rc2-3.3 \|\| =3.2.0~rc3-1 \|\| =3.2.2-1 \|\| =3.2.4-1 \|\| =3.2.4-2 \|\| =3.2.4-3 \|\| >=0 <3.2.6-1	3.2.6-1
rpm rhel6	gimp	-	-
rpm rhel7	gimp	-	-
rpm rhel8	gimp	-	-

Aliases

1. CVE-2026-909492. NVD-2026-909493. OSV-DEBIAN-2026-909494. OSV-2026-909495. SECURITY-TRACKER-CVE-2026-90949

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.