Source: gimp X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerability was published for gimp. CVE-2026-90949[0]: | A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When | processing a compressed selection channel, a heap-based buffer | overflow can occur due to a mismatch between the allocated buffer | size and the amount of data decompressed. A remote attacker could | exploit this vulnerability by crafting a malicious PSP file. Opening | this file in GIMP could lead to a crash or arbitrary code execution. https://gitlab.gnome.org/GNOME/gimp/-/work_items/16753 https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2998 Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/0ff8049449b00bdd906faad7fcea091de8aa00a5 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-90949 https://www.cve.org/CVERecord?id=CVE-2026-90949 Please adjust the affected versions in the BTS as needed.
