CVE-2026-18301

Executive Summary

CVE-2026-18301 is an integer overflow vulnerability in GIMP's PSD file parsing routine that enables remote code execution in the context of the current process. An attacker exploits this flaw by convincing a user to open a maliciously crafted PSD file or visit a malicious page hosting such a file, requiring no prior authentication or elevated privileges. With a CVSS score of 7.8 (High) and confirmed patches across multiple distribution channels, this vulnerability poses a significant risk to any organization using GIMP for image processing — particularly production environments where desktop applications handling untrusted graphic files can serve as initial access vectors.

Technical Analysis

The vulnerability resides in GIMP's parsing logic for Adobe Photoshop Document (PSD) files. PSD is a complex binary format that supports layered compositions, channel data, color modes, and embedded metadata. Parsing this format requires numerous size calculations based on values read directly from the file structure — including layer counts, channel counts, image dimensions, and block sizes.

Vulnerability Mechanism — Integer Overflow Leading to Buffer Overflow

The core flaw is an integer overflow condition (CWE-190) that occurs when GIMP computes the size of a buffer required to store data extracted from the PSD file. When arithmetic operations on user-controlled length fields exceed the maximum value representable by the integer type used (typically 32-bit), the computed value wraps around to a small — or even negative — number.

The sequence of failure is:

1. The PSD file header declares dimensions, bit depth, and color mode
2. Layer/channel metadata contains size descriptors that are read as integer values
3. GIMP performs arithmetic — e.g., multiplying channel count by width times height — to compute an allocation size
4. If the product of these attacker-controlled values exceeds the integer type's maximum, the result wraps to a small value
5. GIMP allocates a buffer based on this truncated/wrapped size — significantly smaller than required
6. Subsequent parsing writes actual file data into the undersized buffer

This creates an integer overflow pre-allocation condition that manifests as a classic heap-based buffer overflow. The result is memory corruption: parsed PSD data written past the bounds of the undersized heap allocation. An attacker controls both the overflow size (through the length fields) and the actual bytes written (file content), enabling precise heap manipulation.

Attack Surface

• File format: PSD (Adobe Photoshop document)
• Attack vector: Local (CVSS AV:L) — requires the user to open a malicious file or visit a malicious page
• Privileges required: None (PR:N) — the attacker does not need any prior access; the attack rides on the victim's user privileges
• User interaction: Required (UI:R) — the attack only succeeds if the target opens the file or navigates to a webpage that triggers PSD parsing
• Complexity: Low (AC:L) — no race conditions, timing windows, or exotic conditions needed

Note on Technical Detail Availability: The NVD description confirms the vulnerability class (integer overflow prior to buffer allocation) and the parsing component (PSD files) but does not disclose specific function names, structure offsets, or the exact code path. Reference is made to ZDI-CAN-29395, indicating this was reported through the Zero Day Initiative program; the full technical analysis is likely reserved for the coordinated disclosure timeline.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-18301 at the time of this report. The attack chain below is inferred from the confirmed vulnerability class (integer overflow → heap buffer overflow during PSD parsing) and standard exploitation of this class.

Step 1 — Target Reconnaissance and Delivery Strategy

The attacker identifies targets that process untrusted image files. High-value targets include:

• Graphic design and media production teams (regularly open files from external contributors)
• Marketing departments receiving promotional assets via email
• Any user with access to sensitive corporate data who regularly downloads images

Delivery methods are driven by the user-interaction requirement:

• Phishing email with a malicious .psd attachment disguised as a logo, mockup, or design asset
• Malicious website hosting the file, with social-engineering lure ("download this template")
• Compromised legitimate sites where the file is planted in a download directory

Step 2 — Triggering the Integer Overflow

The crafted PSD file is engineered so that its internal structure contains oversized length fields — for instance, a layer record claiming an extraordinarily large channel data size or an image header declaring massive dimensions. When GIMP opens the file, its parsing logic performs arithmetic on these values to compute required buffer sizes. The arithmetic overflows the integer type, wrapping the computed size to a value far smaller than the data actually contained in the file.

Step 3 — Payload Execution

The attacker controls the payload bytes written into the undersized heap buffer. Standard heap-overflow exploitation techniques apply:

• Heap grooming: Prior allocations (triggered by the crafted PSD's preceding structures) position adjacent heap objects (function pointers, vtable pointers, or adjacent allocation metadata) near the vulnerable buffer
• Overwrite: The overflowed write corrupts adjacent heap objects
• Control-flow hijack: Corrupted function pointers or vtable entries redirect execution to an attacker-controlled memory region (e.g., heap spray with shellcode) or to a ROP chain

The payload executes in the context of the GIMP process — i.e., with the privileges of the user who opened the file.

Step 4 — Post-Exploitation

Successful code execution grants the attacker:

• Access to all files readable by the current user
• Ability to install persistent malware (e.g., keyloggers, credential-stealing tools)
• Potential for lateral movement if the compromised host holds domain credentials or network trust relationships

Given CVSS subscores of C:H/I:H/A:H (High confidentiality, integrity, and availability impact), the full extent of the victim's data and system control is compromised.

Impact Assessment

Business Impact:

• Confidentiality (High): Full read access to the victim's files, documents, credentials, and email
• Integrity (High): Attacker can modify, encrypt, or destroy data; install backdoors and persist across reboots
• Availability (High): Attacker can render the system inoperable or deploy ransomware in the context of the compromised user

Affected Systems:

All GIMP installations that parse PSD files are vulnerable prior to the vendor patch. GIMP is cross-platform (Windows, macOS, Linux), expanding the affected footprint to any device with GIMP installed. Given the confirmed patch across NVD, Debian, and RHSA (Red Hat Security Advisory), Linux distributions shipping GIMP in their repositories are expressly affected. No specific version range was provided in the source data; organizations should assume all versions up to the point of the official patch are vulnerable.

Blast Radius:

• Initial access vector: The UI:R requirement constrains exploitation to social-engineering vectors but in practice, employees in creative roles process dozens of external image files daily — making the "user opens a file" condition easily satisfied
• Enterprise context: A compromise of a desktop workstation in a corporate environment can expose network shares, cached credentials, and provide a foothold for lateral movement using standard techniques
• EPSS percentile context: The EPSS score of 0.00339 (26.6th percentile) indicates that at the time of scoring, exploitation likelihood was below the majority of known CVEs — but this metric reflects observed exploitation, not inherent risk. This is a locally-triggered client-side bug requiring user interaction, so automated mass-scanning exploitation is not expected; targeted phishing campaigns remain the primary concern

Detection Guidance

Detection of this vulnerability is challenging because exploitation occurs entirely through a file-parsing operation on the local machine with no distinct network signature. Detection should therefore focus on: (1) file characteristics, (2) GIMP process anomalies, and (3) post-exploitation behavior indicators.

Sigma Rule

title: GIMP PSD Parsing Integer Overflow Exploitation Attempt
id: c6ef2d18-9b5a-4c7e-b73f-1c9c0490a3a4
status: experimental
description: Detects potential exploitation of CVE-2026-18301 via suspicious GIMP process behavior and oversized PSD file indicators
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18301
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1203
    - cve.2026.18301
    - cwe.190
logsource:
    category: process_creation
    product: windows
detection:
    selection_gimp:
        Image|endswith:
            - '\gimp-2.10.exe'
            - '\gimp-2.99.exe'
            - '\gimp.exe'
    selection_crash:
        CommandLine|contains:
            - '.psd'
        EventID:
            - 1
    condition: selection_gimp and selection_crash
    timeframe: 5m
falsepositives:
    - Legitimate use of GIMP to open PSD files
level: medium

# Additional Hunting Sigma - Anomalous Process Behavior
title: GIMP Process Crash After PSD File Access
id: 8f4c2b57-d3e9-4a81-bd9e-7d57b0ec6f24
status: experimental
description: Detects GIMP crashing shortly after accessing a PSD file, potentially indicating memory corruption exploitation
logsource:
    category: application
    product: windows
detection:
    selection_error:
        Provider_Name: 'Application Error'
        EventID: 1000
        Message|contains:
            - 'gimp'
    filter_ts:
        EventID: 1001
    condition: selection_error and not filter_ts
level: high

YARA Rule

/*
    YARA rule for CVE-2026-18301 - GIMP PSD Integer Overflow
    Detects suspicious PSD file headers and oversized dimension fields
    consistent with integer overflow triggering structures
*/
rule GIMP_PSD_IntegerOverflow_CVE_2026_18301 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PSD files with dimensions/size fields capable of triggering integer overflow in GIMP parser"
        cve = "CVE-2026-18301"
        cwe = "CWE-190"
        date = "2026-01-15"

    strings:
        // PSD file signature '8BPS'
        $psd_magic = { 38 42 50 53 }
        // Version 1 (big-endian 0x0001)
        $psd_version = { 00 01 }

    condition:
        // PSD signature at file offset 0
        $psd_magic at 0 and
        // Flag overly large dimension declarations (width/height > 4 billion
        // pixels impossible in practice for 32-bit math)
        (
            // Check width field (bytes 18-21) for leading 0xFF byte = >16M width
            (uint32(18) & 0xFF000000) == 0xFF000000 or
            // Check height field (bytes 22-25)
            (uint32(22) & 0xFF000000) == 0xFF000000 or
            // Check channel count field (bytes 12-13) for max value 0xFFFF
            uint16(12) == 0xFFFF or
            // Oversized layer count in Layer and Mask info (variable offset,
            // check pattern of large big-endian values)
            for any i in (26..filesize-128) : (
                uint32(i) > 0x80000000 and
                uint32(i+4) > 0x80000000
            )
        )
}

Suricata IDS Rule

Network detection of this vulnerability is limited since exploitation occurs via local file parsing. However, network-level monitoring can flag PSD file transfers that carry malicious structures:

alert http any any -> any any (msg:"GIMP PSD Integer Overflow CVE-2026-18301 - Potential Malicious PSD Download"; flow:established,to_client; file.magic:"Adobe Photoshop"; file.size:>100000; content:"8BPS"; offset:0; depth:4; content:"|00 01|"; offset:4; depth:2; classtype:attempted-user; reference:cve,2026-18301; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18301; sid:202618301; rev:1;)

alert smtp any any -> any any (msg:"GIMP PSD Integer Overflow CVE-2026-18301 - PSD Attachment Potential Malware"; flow:established; content:"filename="; nocase; content:".psd"; nocase; distance:0; within:50; file.magic:"Adobe Photoshop"; classtype:attempted-user; reference:cve,2026-18301; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18301; sid:202618302; rev:1;)

alert http any any -> any any (msg:"GIMP PSD Overflow CVE-2026-18301 - HTTP PSD Transfer with Oversized Header Fields"; flow:established,to_client; file.magic:"Adobe Photoshop"; content:"|FF FF|"; offset:12; depth:2; content:"|FF|"; offset:18; depth:1; classtype:attempted-user; reference:cve,2026-18301; sid:202618303; rev:1;)

Elastic Detection

// EQL rule to detect potential GIMP exploitation behavior

sequence by process.entity_id with maxspan=10m
  [ process where process.name : "gimp*" and
    event.action == "executed" and
    process.args : "*.psd"
  ]
  [ process where process.name : "gimp*" and
    event.category : ("process", "file") and
    event.action in ("exit", "terminated") and
    process.exit_code : (
      0xC0000005,        // Access Violation
      0xC00000FD,        // Stack Overflow
      0xC0000409,        // STATUS_STACK_BUFFER_OVERRUN
      3221225477,        // 0xC0000005 decimal
      139                 // SIGSEGV common on Linux
    )
  ]

// Alternative: Detect subsequent abnormal child processes from GIMP
process where event.type == "start" and
  process.parent.name : "gimp*" and
  not process.executable : ("C:\\Program Files\\GIMP*", "/usr/bin/*", "/usr/lib/gimp/*")

Splunk SPL Query

# Detect GIMP process crashes as potential exploitation of CVE-2026-18301
index=windows EventCode=1000 OR EventCode=1001
| search "gimp*.exe" OR "GIMP"
| where like(Message, "%faulting application%")
| stats count by host, _time, Message
| sort - _time

# Detect GIMP launched with PSD files and subsequent abnormal behavior  
index=windows EventCode=1
| search process_name=gimp*.exe
| regex CommandLine=".*\.psd.*"
| stats values(CommandLine) as cmdline, count by host
| where count > 0

# Hunt: GIMP process creating or writing to suspicious directories
index=windows EventCode=11 OR EventCode=2
| search process_name=gimp*.exe
| search TargetFilename IN ("*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu*",
                            "*\\AppData\\Local\\Temp\\*.exe",
                            "*\\Users\\Public\\*.exe",
                            "*/tmp/*")
| stats count by host, TargetFilename, process_name

# Linux variant: Auditd or syslog for segfaults in GIMP processes
index=linux sourcetype=auditd OR sourcetype=syslog
| search "gimp" AND ("segfault" OR "SIGSEGV" OR "SIGABRT" OR "crash")
| stats count by host, source, message

Wazuh OSSEC Rule

<group name="gimp,cve-2026-18301,">
    <!-- Rule: GIMP process crash after PSD access (Windows Event Log) -->
    <rule id="785943" level="10">
        <if_sid>18100</if_sid> <!-- Microsoft Event Log Rule Group -->
        <field name="win.system.eventID">^1000$</field>
        <match>gimp</match>
        <description>GIMP (CVE-2026-18301) - process crash possibly caused by PSD parsing integer overflow exploitation</description>
        <group>gimp_vuln,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
    </rule>

    <!-- Rule: GIMP running with PSD file argument -->
    <rule id="785944" level="5">
        <if_sid>510</if_sid> <!-- Process execution -->
        <match>\.psd</match>
        <regex>gimp</regex>
        <description>GIMP process executed with PSD file argument - potential attack vector for CVE-2026-18301</description>
        <group>gimp_vuln,</group>
    </rule>

    <!-- Rule: Linux GIMP segfault (decoded from syslog/audit) -->
    <rule id="785945" level="10">
        <if_sid>1002</if_sid> <!-- Generic Linux log -->
        <match>gimp.*segfault|segfault.*gimp</match>
        <description>GIMP (CVE-2026-18301) - Segmentation fault observed, potential memory corruption from PSD parsing</description>
        <group>gimp_vuln,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
    </rule>

    <!-- Grouping: Active response capability -->
    <rule id="785946" level="12" frequency="5" timeframe="300">
        <if_matched_sid>2026183,2026185</if_matched_sid>
        <description>GIMP (CVE-2026-18301) - Multiple crash events, possible repeated exploitation attempts</description>
        <group>gimp_vuln,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 4/4 (CONFIRMED) — The fix is verified by three independent sources: NVD, Debian security advisories, and Red Hat Security Advisories (RHSA). All maintainers have confirmed that patched versions address the integer overflow condition.

1. Immediate Mitigations (until patch applied):

• Restrict PSD file access: Where possible, block .psd attachments at email gateways and web filters for users who do not have a legitimate business need for Photoshop files
• User awareness: Notify design/media teams to only open PSD files from trusted internal sources; refuse unsolicited PSD files from external parties
• Least privilege: Run GIMP under a non-administrator account; on Windows, consider AppLocker or Software Restriction Policies preventing GIMP from launching child processes unless explicitly whitelisted
• Sandboxing / virtualization: For high-risk workflows (processing untrusted external files), run GIMP inside a virtual machine or container with no network access and no mount to sensitive shares
• Alternate viewers: Use built-in OS image previewers that employ different parsing engines when only visual inspection is required

2. Patch/Upgrade Steps:

• Debian/Ubuntu: sudo apt update && sudo apt upgrade gimp
• RHEL/CentOS/Fedora: sudo yum update gimp or sudo dnf upgrade gimp (per applicable RHSA advisory)
• Windows/macOS (direct install): Download the patched version from the official GIMP website (gimp.org) — verify the version against release notes confirming CVE-2026-18301 fix
• Verify current version: gimp --version (CLI) or check Help → About in the GUI
• If a package manager is the distribution source (e.g., Homebrew, Snap, Flatpak), update through the respective channel: snap refresh gimp, flatpak update org.gimp.GIMP, brew upgrade gimp

3. Long-Term Hardening:

• File-type policy enforcement: Implement allowlisting at the email gateway and file download proxy level — restrict .psd delivery channels to authorized internal workflows only
• Security baseline updates: Create a schedule for routine application security audits, prioritizing image-processing tools that handle complex binary formats
• EDR/AV deployment: Ensure endpoint detection and response (EDR) agents are active on workstations used for graphic design. The absence of network indicators for this vulnerability makes behavioral EDR detection essential
• User training: Phishing awareness training should specifically address malicious attachment types beyond macros and executables — including graphics and media formats (PSD, SVG, PDF)
• Patch management SLA: Maintain an SLA for critical client-side parsing vulnerabilities (CVSS ≥ 7.0) of 48–72 hours to patch since their exploitation lifecycle is driven by user-open behavior which cannot be network-blocked

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18301 — Official vulnerability record with CVSS vector, CWE classification, and reference to ZDI-CAN-29395
2. Zero Day Initiative (ZDI): https://www.zerodayinitiative.com/advisories/ — Reference ZDI-CAN-29395 for researcher publication of full technical details (advisory forthcoming per standard ZDI disclosure timeline)
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-18301 — Distribution-specific patch status and affected/patched package versions
4. Red Hat Security Advisory (RHSA): https://access.redhat.com/security/cve/CVE-2026-18301 — RHSA reference confirming patch availability for RHEL-distributed GIMP packages
5. GIMP Official Site: https://www.gimp.org — Vendor download page for obtaining patched versions

Threat Actor Activity Note: CISA KEV (Known Exploited Vulnerabilities) status is NO, indicating no confirmed exploitation in the wild as of this report's date. No public PoC or exploit code has been released. The EPSS 26.6th percentile score reflects a low observed-exploitation rate for this vulnerability class at time of scoring. However, given the confirmed 4/4 patch confidence and the history of image-parsing vulnerabilities (GIMP, ImageMagick, ghostscript) transitioning from private ZDI research to weaponized exploit kits following disclosure, targeted phishing campaigns by advanced persistent threat (APT) groups are a realistic medium-term concern for organizations in media, defense, and technology sectors where graphic files circulate regularly.