CVE-2026-58381 Red Hat CVE debrief

Who should care

Defenders responsible for GIMP installations, especially in environments where untrusted PSP files may be processed, should assess exposure and prioritize verification and patching.

Why it matters

A flaw in GIMP's PSP file format parser could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution. Defenders should prioritize verifying exposure in GIMP installations, especially in environments where untrusted PSP files may be processed, and apply patches or updates as available.

• Potential denial of service due to memory corruption.
• Possible arbitrary code execution if exploitation is successful.
• Verification of GIMP installations and PSP file processing environments is necessary.
• Patching or updating GIMP to a secure version is required.

Technical summary

A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP file, potentially leading to memory corruption. This vulnerability affects GIMP installations, especially in environments where untrusted PSP files may be processed. The CVE record and NVD detail page provide information about the vulnerability, but do not provide specific affected versions beyond GIMP 3.2.1. Defenders should prioritize verifying exposure in GIMP installations and apply patches or updates as available.

Defensive priority

Defenders should prioritize verifying exposure in GIMP installations, especially in environments where untrusted PSP files may be processed.

Recommended defensive actions

• Verify GIMP installations for exposure, especially in environments where untrusted PSP files may be processed.
• Apply patches or updates to GIMP as available.
• Monitor GIMP logs for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information about the vulnerability, but do not provide evidence of exploitation or specific affected versions beyond GIMP 3.2.1. There is no information on publicly available exploits or reports of exploitation. Defenders should verify GIMP installations, especially in environments where untrusted PSP files may be processed, and apply patches or updates as available. The official CVE Program record and NVD detail page are provided as references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.