This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-90949 →

DEBIAN-CVE-2026-90949

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur du...

Original description

The description as published by the source.

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:14 gimp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-1"}]}]

References

advisory security-tracker.debian.org