CVE-2026-58384CWE-190

CVE-2026-58384

High · published July 7, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-07-07T13:16Z
Affected products (2)
ProductVersionsFixed in
gimp/gimpall versions—
redhat/enterprise_linuxall versions—
References (7)
https://access.redhat.com/errata/RHSA-2026:40751 · [email protected]https://access.redhat.com/errata/RHSA-2026:73768 · [email protected]https://access.redhat.com/errata/RHSA-2026:80509 · [email protected]https://access.redhat.com/security/cve/CVE-2026-58384 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2497431 · [email protected]https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217 · [email protected]https://gitlab.gnome.org/GNOME/gimp/-/issues/16216 · [email protected]
EPSS history
Timeline
  • 07 JUL 07:44Z
    Gimp: gimp: integer overflow in read_rle_channel()
    cvelistv5