{"affected":[{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:2.8/gimp","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gimp:gimp:3.2.0:rc2:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-2271","cwes":["CWE-190"],"description":"A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() function by providing a specially crafted PSP image file. This vulnerability occurs when a 32-bit length value from the file is used for memory allocation without proper validation, leading to a heap overflow and an out-of-bounds write. Successful exploitation could result in an application level denial of service.","epss":{"date":"2026-11-05","percentile":0.43923,"score":0.00513},"exploits":[{"kind":"exploit","source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2438429"},{"kind":"exploit","source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/15732"}],"kev":null,"metrics":[{"score":3.3,"severity":"low","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},{"score":5.5,"severity":"medium","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},{"score":3.3,"severity":"low","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793899096350,"publishedAt":1774555209397,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-2271"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2438429"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/15732"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-2271"},{"source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2438429"},{"source":"secalert@redhat.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/15732"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"revision":"1d5b36a708989de6863668ae47d6fa17b45d0da41a5191f8f8bf45349b8fd2e1","sources":[{"modifiedAt":1793897416363,"name":"CNA: redhat","retrievedAt":1793898814823,"url":"https://www.cve.org/CVERecord?id=CVE-2026-2271"},{"modifiedAt":1793899096350,"name":"NVD","retrievedAt":1793902821668,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2271"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793898841428,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-2271"}],"ssvc":{"assessedAt":1774641156619,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Gimp: gimp: denial of service via crafted psp image file","updatedAt":1793902821668}