CVE-2026-82343

Executive Summary

CVE-2026-82343 is an unpatched memory safety vulnerability in the file-psd plugin of GIMP, a widely used open-source image manipulation application. The flaw is triggered when a user opens a specially crafted PSD (Photoshop Document) image, allowing an attacker to cause a heap out-of-bounds read and a stack out-of-bounds access due to improper validation of the channel-count parameter. Successful exploitation results in an application crash (denial of service) or limited disclosure of in-memory data, with a CVSS base score of 6.1. Any system running GIMP with the file-psd plugin enabled is potentially affected, and the lack of an available patch means users must apply workaround mitigations to reduce exposure.

Technical Analysis

The vulnerability resides in the file-psd plugin, which is the component of GIMP responsible for parsing Adobe Photoshop (PSD) file formats. The root cause is a failure to properly validate the channel-count parameter embedded within the PSD file header or associated metadata during the parsing process.

PSD files contain a header structure that specifies properties such as color mode, bit depth, and the number of color channels. The channel-count value determines how many channel data blocks the parser expects to read from the file. When this value is not validated against the actual structure of the file, the parser will attempt to allocate or iterate over memory regions based on the untrusted count.

Specifically, improper validation of channel-count leads to two distinct memory safety failures:

1. Heap Out-of-Bounds Read (CWE-120): When the channel-count value is larger than the actual number of channels present in the file, the parser will attempt to read data beyond the allocated heap buffer. This out-of-bounds read may access adjacent heap memory, potentially returning arbitrary data from the process heap.

2. Stack Out-of-Bounds Access: Incorrect channel-count validation also causes the parser to index into a stack-allocated array or structure during the channel-processing loop. A misvalidated count can push the index beyond the stack frame boundaries, leading to a stack out-of-bounds read or write, which is generally more dangerous as it directly affects control flow data such as return addresses.

The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), though the mechanism is better characterized as missing bounds check on the channel-count parameter prior to memory operations.

Attack Surface: The primary attack surface is the file-parse path of the PSD importer. No authentication or privileges are required — an attacker only needs to deliver a malicious PSD file to the victim and convince them to open it with GIMP. The CVSS vector confirms local attack vector with user interaction required (AV:L/UI:R).

The vulnerability class is a memory-corruption flaw triggered by malformed file structure, which is a common pattern in image parsers. File format parsers are historically high-risk components because they process attacker-controlled binary data with complex, often legacy, format specifications.

Affected Version Scope: The NVD entry does not specify a version range. The vulnerability affects the file-psd plugin in GIMP, which is likely present in most or all GIMP 2.x versions. This is consistent with the CNA title and NVD description, though sufficient technical detail is not available to enumerate specific affected builds.

Exploitation Scenarios

No public proof-of-concept is available, and the attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Target Identification and Delivery: An attacker identifies a target user or organization that uses GIMP. The delivery vector is social engineering — the attacker crafts a malicious PSD file and distributes it via email attachment, malicious website download, or shared document repositories. The victim must be convinced to open the file with GIMP, satisfying the user-interaction requirement (AV:UI:R).

Step 2 — Triggering the Flaw: The malicious PSD file contains a channel-count parameter set to an invalid value — either excessively high, zero, or negative (interpreted as a large unsigned integer). When the file-psd plugin begins parsing the file header and channel metadata, it reads the channel-count value but fails to validate it against the file size or expected structure.

Step 3 — Exploitation Mechanism (Class-Level): At the vulnerability-class level (memory bounds-check failure in a file parser), the attack proceeds as follows: the parser allocates a heap buffer for channel data based on the declared size, then iterates over the total number of channels specified by the file, reading data for each channel. If the channel-count is larger than what the file actually contains, the parser reads past the end of the allocated heap buffer. In parallel, the parser indexes into a stack-allocated array of channel metadata structures; the oversized count drives the index beyond the array bounds. A stack out-of-bounds write (or read) can corrupt adjacent stack variables or return addresses, enabling potential code execution — though the NVD description only confirms crash and memory disclosure capabilities.

Step 4 — Post-Exploitation Impact: The CVSS vector indicates two outcomes:

• Availability Impact: High — the out-of-bounds access results in a segmentation fault or assertion failure, crashing the application.
• Confidentiality Impact: Low — the heap out-of-bounds read can leak limited data from the process heap into the parser's output, which may be exposed in error messages, logging, or rendered output.

In the worst case — if an attacker can turn the Stack OOB access into control-flow hijacking — code execution with the privileges of the GIMP process is theoretically possible. However, no public PoC exists, and the low confidentiality score suggests the primary observed impact is denial of service.

Proof of Concept Intelligence

No public proof-of-concept is currently available for this vulnerability. However, exploitation may still be possible for the following reasons:

1. Otherwise Unknown Specifies: The vulnerability has CWE-120 (generic buffer operations) classification, meaning any sufficiently experienced vulnerability researcher or penetration tester could replicate the flaw by analyzing the PSD file format parser code.
2. Public Availability of the File Format: The PSD format is publicly documented, and fuzzing the channel-count field with a standard file-format fuzzer (e.g., AFL, libFuzzer, honggfuzz) could yield a crash that triggers the issue.
3. Historical Precedent: Similar PSD parsing flaws in public image libraries have been discovered and exploited, meaning the vulnerability class is well-understood and testable.

Defenders should monitor the following resources for future PoC disclosure:

• The NVD page for CVE-2026-82343 (https://nvd.nist.gov/vuln/detail/CVE-2026-82343) for updates and reference additions.
• The GIMP GitLab issue tracker (gitlab.gnome.org/GNOME/gimp) for bug reports describing similar PSD parsing crashes.
• Public exploit databases (Exploit-DB, Packet Storm, GitHub vulnerability advisories) for uploads related to this CVE.
• The GIMP project release notes for any emergency patch announcements.

Impact Assessment

Business Impact: GIMP is widely deployed in both individual and enterprise environments as a free alternative to commercial image editors. Organizations using GIMP in production workflows — including graphic design teams, web content producers, and documentation teams — are exposed. A malicious PSD file delivered via phishing or legitimate software supply chain channels can cause the application to crash, interrupting workflows and requiring end-user intervention. The limited memory disclosure could expose sensitive data processed in the same GIMP process, though the impact is rated Low.

Affected Systems: Any workstation or server running GIMP with the file-psd plugin enabled. This includes:

• Windows workstation deployments
• Linux desktop distributions (where GIMP is commonly pre-installed or available via package management)
• macOS systems with GIMP installed

Blast Radius: The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates:

• Local attack vector — the file must be opened locally on the target system
• Low attack complexity — no special conditions or race conditions required
• No privileges required — exploitation occurs in the context of the unprivileged user opening the file
• User interaction required — opening the malicious file is necessary

The Confidentiality impact is Low (C:L) and Availability impact is High (A:H), resulting in the composite score 6.1. The absence of Integrity impact (I:N) means data tampering is not a direct concern.

Supply Chain Risk: GIMP's file-psd plugin is part of the core distribution, not a separately maintained third-party package. No OSV package data is available. Any GIMP installation from any distribution channel is potentially affected.

Detection Guidance

Sigma Rule

title: GIMP file-psd CVE-2026-82343 Malicious PSD Execution Attempt
id: 7b3d7f4e-1c42-4a5e-9c9f-3a4b5c6d7e8f
status: experimental
description: Detects GIMP process crashes or heap-related failures when processing PSD files consistent with CVE-2026-82343 channel-count validation bypass.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82343
author: vartersit.com Threat Intelligence
date: 2026/01/15
logsource:
    category: process_creation
    product: windows
    definition: 'Requirements: Windows Event ID 4688 with command-line auditing enabled'
detection:
    selection_psd:
        Image|endswith:
            - '\gimp-2.10.exe'
            - '\gimp-2.99.exe'
            - '\gimp.exe'
        CommandLine|contains:
            - '.psd'
            - '.PSD'
    selection_crash:
        EventID: 4688
        NewProcessName|endswith:
            - '\WerFault.exe'
            - '\gimp-2.10.exe'
    condition: selection_psd and selection_crash
level: medium
falsepositives:
    - Legitimate PSD files opened by users
    - System crashes unrelated to PSD parsing
tags:
    - attack.t1203
    - cve.2026.82343

YARA Rule

rule CVE_2026_82343_GIMP_PSD_Malicious
{
    meta:
        author = "vartersit.com Threat Intelligence"
        description = "Detects PSD files with anomalous channel-count fields potentially targeting the GIMP file-psd plugin (CVE-2026-82343)"
        cve = "CVE-2026-82343"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82343"
        score = 60

    strings:
        $psd_magic = "8BPS"               // PSD file signature
        $version_1 = { 00 01 }            // Version 1 (0x0001)
        $version_2 = { 00 02 }            // Version 2 (0x0002)

    condition:
        uint32(0) == 0x38425053          // "8BPS" at offset 0
        and (uint16(4) == 1 or uint16(4) == 2)
        // Check channels field at offset 12 (2 bytes)
        and uint16(12) > 16               // Anomalous: channel counts > 16 are highly unlikely for valid PSB/PSD
}

Suricata IDS Rule

Given the local attack vector (CVSS AV:L) and the file-based exploitation mechanism, network packet inspection has limited effectiveness. The malicious PSD file is transmitted via standard protocols (HTTP, SMTP, SMB) in a manner indistinguishable from legitimate file transfers. Instead of a network rule, defenders should focus on host-level detection:

1. Host-Level Artifacts: Exploitation of this vulnerability leaves artifacts including truncated process crash dumps (in Windows: %LOCALAPPDATA%\CrashDumps\gimp-2.10.exe.*.dmp; in Linux: core dumps at the path configured by kernel.core_pattern), Windows Error Reporting (WER) entries in the Application event log with event ID 1000 or 1001 referencing gimp-2.10.exe and a faulting module in the file-psd plugin, and filesystem artifacts of the malicious PSD file (which may retain unusual metadata or exhibit abnormally small file sizes relative to declared channel counts).

2. Most Effective Endpoint Detection Sources: Process event logs (Windows Event ID 4688 with command-line auditing enabled to record the GIMP process invocation with the .psd file argument) are the primary source. Additionally, file system audit logs (SACL auditing on .psd extensions in shared directories) capture file access events. Application crash logs from Windows Event Viewer (Application log) and Linux syslog (/var/log/messages containing segfault at lines referencing GIMP) are critical. Sysmon Event ID 1 (Process Creation) and Event ID 11 (File Create) also provide high-fidelity telemetry.

3. Specific Indicators to Monitor: (a) GIMP process terminating with exception code 0xC0000005 (access violation) in the Application event log; (b) Crash dump files created for GIMP on the target host; (c) PSD files with declared channel counts exceeding the maximum valid value (16 for PSD, 56 for PSB) in the file header; (d) Repeated GIMP crash events in a short time window, indicating potential fuzzing or scanning activity; (e) Sysmon Event ID 1 showing gimp-2.10.exe invoked with arguments referencing .psd files located in temporary directories or web browser download folders.

Elastic Detection

// Detect GIMP PSD processing followed by crash — CVE-2026-82343
sequence by host.name with maxspan=5m
    [ process where event.action == "start" and
        process.name : ("gimp-2.10.exe", "gimp.exe", "gimp-2.99.exe")
        and process.command_line : "*.psd*"
    ]
    [ process where event.action == "end" and
        process.name : ("gimp-2.10.exe", "gimp.exe", "gimp-2.99.exe")
        and process.exit_code != 0
    ]
    [ any where event.code : "1000" or
        event.message : "faulting module name: *file-psd*" ]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Application EventCode=1000
| where message like "%gimp%"
| rename Message as details
| stats count by host, TimeGenerated, Message
| where count > 3
| eval suspicious = "GIMP Crash - potential CVE-2026-82343"
| table TimeGenerated, host, Message, count, suspicious

Alternative query for Linux hosts:

index=linux sourcetype=syslog
| regex _raw="gimp.*segfault|gimp.*signal 11|gimp.*core dumped"
| eval suspicious="GIMP Crash - potential CVE-2026-82343"
| table _time, host, _raw, suspicious

Wazuh OSSEC Rule

<group name="gimp,psd,cve-2026-82343,">
    <rule id="100823" level="10">
        <decoded_as>syslog</decoded_as>
        <match>gimp.*segfault|gimp.*core dumped|gimp.*signal 11</match>
        <regex>\.psd|\.PSD</regex>
        <description>GIMP crash detected - potential CVE-2026-82343 PSD channel-count exploitation</description>
        <group>memory_corruption,denial_of_service,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED, with no patch evidence from any tracked source.

1. Immediate Mitigations (No Patch Available)

• Restrict PSD File Processing: If GIMP is not essential for the organization's workflow, temporarily remove or disable the file-psd plugin. On Linux, remove or rename the plugin file (/usr/lib/gimp/2.0/plug-ins/file-psd or similar) to prevent PSD parsing.
• User Education: Implement a security awareness campaign warning users not to open PSD files from untrusted sources via email, web downloads, or removable media.
• File Sanitization: Deploy a file sanitization gateway (e.g., Content Disarm & Reconstruction solution) that strips PSD attachments or replaces them with sanitized rasterized versions (PNG/JPEG) before delivery, preventing the malicious file from reaching the desktop.
• Sandboxing: Run GIMP in an application sandbox (e.g., Windows Sandbox, Firejail on Linux, or a dedicated virtual machine) for any business process that must routinely open PSD files.
• Egress Filtering: Since the vulnerability can leak limited heap memory, restrict the GIMP process from network access (e.g., via Windows Firewall or Linux iptables rules for the application user) to prevent any data exfiltration of leaked memory content.

2. Patch/Upgrade Steps

• Monitor the GIMP project's release announcements (https://www.gimp.org/news/) for a security update that addresses this CVE. Continue until a patched version is announced.
• When a fix is released, patch all GIMP installations across the organization immediately. For managed Linux distributions (RHEL, Ubuntu, Debian), the patch will be delivered via the distribution's security update repository.
• For Windows installations, update via the GIMP official installer or the winget package manager (winget upgrade GIMP.GIMP).
• After the fix is applied, verify the GIMP version string and ensure the file-psd plugin loads without errors during the update process.

3. Long-Term Hardening

• Application Allowlisting: Implement application allowlisting (e.g., Microsoft AppLocker or Windows Defender Application Control) to restrict which applications can execute. This limits the blast radius should a malicious GIMP process be launched.
• Email Attachment Filtering: Configure email security gateways to block .psd attachments at the perimeter unless explicitly approved, and log all blocked attempts for security review.
• Regular Vulnerability Scanning: Include GIMP in the organization's software inventory and vulnerability management program to detect future CVEs involving the application.
• Backup and Recovery: Maintain regular endpoint backups so that any systems experiencing sustained denial-of-service attack through this vulnerability can be restored rapidly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82343 — Official NVD vulnerability record with CVSS vector and description.
2. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82343 — CVE record maintained by MITRE.
3. GIMP Official Site: https://www.gimp.org — Vendor site for release announcements, security updates, and communication channels.
4. GIMP GitLab Issue Tracker: https://gitlab.gnome.org/GNOME/gimp/issues — Monitor for bug reports and fix reference commits related to this vulnerability.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-82343 is NOT listed (NO KEV designation); this page should be monitored for updates should exploitation be observed in the wild.

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence has been publicly reported at the time of writing. The lack of a public PoC and the low CVSS score (6.1) may limit immediate interest from advanced persistent threat actors, but the vulnerability remains a viable concern for denial-of-service attacks in environments where GIMP is business-critical.