CVE-2026-58381 Details
Description
A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file. This could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.
A double-free vulnerability has been identified in GIMP's Paint Shop Pro (PSP) file format parser, specifically in the 'read_layer_block()' function of 'file-psp.c'. This vulnerability arises when the function processes specially crafted PSP files, leading to a double-free condition. The flaw allows for memory corruption, which could be exploited to cause a denial-of-service or potentially execute arbitrary code. The vulnerability affects GIMP versions prior to 3.2.2.
Users can update to GIMP version 3.2.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-58381 | [email protected] | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2496166 | [email protected] | Issue TrackingVendor Advisory |
| https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b | [email protected] | Patch |
| https://gitlab.gnome.org/GNOME/gimp/-/issues/16207 | [email protected] | Vendor AdvisoryIssue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gimp gimp | <= 3.2.1 |
CPE
Remediation
| |
| redhat enterprise linux | 6.0 7.0 8.0 9.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | [email protected] |