# CVE-2026-92248: Gimp: integer overflow when generating a thumbnail preview for a psd file

Status: published. Published: 2026-09-15. Updated: 2026-11-02.

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

## Remediation

- workaround: To mitigate this vulnerability, do not navigate to directories containing PSD files from untrusted sources using the GIMP file chooser. Additionally, users can disable thumbnail generation in the preferences to prevent the vulnerable code path from being reached. (source: CNA: redhat)

## Affected products and versions

- GNOME / GIMP (gimp): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (gimp:2.8): ≥ 8100020261015094823.4c9c024f; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (gimp): ≥ 2:3.0.4-4.el9_8.14; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (gimp): ≥ 2:2.99.8-4.el9_2.7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (gimp): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (gimp): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (gimp): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-01; percentile 8.39%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-190

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:75575 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:84744 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:93589 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-92248 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2534282 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16775 (CNA: redhat)

- https://access.redhat.com/errata/RHSA-2026:75575 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:84744 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:93589 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-92248 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2534282 (secalert@redhat.com)

- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16775 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-92248; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92248; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-92248; retrieved 2026-11-02; source updated Not reported

Revision: 1b29140dd234022ae3d98cde67347624b987db4dfb54ffd3835f2f6c7072b028

Canonical: https://y2.dev/cve/CVE-2026-92248