CVE-2026-2271

Name	CVE-2026-2271
Description	A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() function by providing a specially crafted PSP image file. This vulnerability occurs when a 32-bit length value from the file is used for memory allocation without proper validation, leading to a heap overflow and an out-of-bounds write. Successful exploitation could result in an application level denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4483-1, DSA-6139-1
Debian Bugs	1127841

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gimp (PTS)	bullseye	2.10.22-4+deb11u2	vulnerable
	bullseye (security)	2.10.22-4+deb11u7	fixed
	bookworm	2.10.34-1+deb12u5	vulnerable
	bookworm (security)	2.10.34-1+deb12u9	fixed
	trixie (security), trixie	3.0.4-3+deb13u7	fixed
	forky, sid	3.2.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
gimp	source	bullseye	2.10.22-4+deb11u6	DLA-4483-1
gimp	source	bookworm	2.10.34-1+deb12u8	DSA-6139-1
gimp	source	trixie	3.0.4-3+deb13u6	DSA-6139-1
gimp	source	(unstable)	3.2.0~RC2-3.2		1127841

Notes

https://gitlab.gnome.org/GNOME/gimp/-/issues/15732
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/d9d0f5b4e642dd5b101e70728042027d568bb01d
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/0e63f096fa5f7dc3fae0a8e865fd5a05ebe45da8 (GIMP_3_0_8)