{"id":"CVE-2026-58384","state":"PUBLISHED","title":"Gimp: gimp: integer overflow in read_rle_channel()","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","publishedAt":"2026-07-07T07:44:28.139Z","updatedAt":"2026-10-12T02:08:06.811Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-4.el9_8.7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_4.19","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_6.20","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"gimp","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"gimp","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gimp:2.8/gimp","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":["https://access.redhat.com/errata/RHSA-2026:40751","https://access.redhat.com/errata/RHSA-2026:73768","https://access.redhat.com/errata/RHSA-2026:80509","https://access.redhat.com/security/cve/CVE-2026-58384","https://bugzilla.redhat.com/show_bug.cgi?id=2497431","https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217","https://gitlab.gnome.org/GNOME/gimp/-/issues/16216"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/58xxx/CVE-2026-58384.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-58384","state":"PUBLISHED","datePublished":"2026-07-07T07:44:28.139Z","dateUpdated":"2026-10-12T02:08:06.811Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-06-30T16:54:04.312Z"},"containers":{"cna":{"title":"Gimp: gimp: integer overflow in read_rle_channel()","descriptions":[{"lang":"en","value":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-4.el9_8.7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_4.19","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_6.20","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"gimp","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"gimp","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gimp:2.8/gimp","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:40751","name":"RHSA-2026:40751","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73768","name":"RHSA-2026:73768","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80509","name":"RHSA-2026:80509","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58384","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497431","name":"RHBZ#2497431","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16216"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"Integer Overflow or Wraparound","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-12T02:08:06.811Z"},"datePublic":"2026-04-11T00:00:00.000Z","x_redhatCweChain":"CWE-190: Integer Overflow or Wraparound","workarounds":[{"lang":"en","value":"None — requires opening a crafted PSD file."}],"timeline":[{"lang":"en","time":"2026-04-11T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-11T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank bb1abu for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-07T13:30:05.659315Z","id":"CVE-2026-58384","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-07T13:31:00.757Z"}}]}}}