---
id: CVE-2026-2271
title: 'Gimp: gimp: denial of service via crafted psp image file'
summary: >-
  A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker
  could exploit an integer overflow vulnerability in the read_creator_block()
  function by providing a specially crafted PSP image file. This vulnerability
  occur…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-190
vendor: Red Hat
product: gimp
affected:
  - gimp
  - gimp (all versions)
  - 'gimp:2.8/gimp (all versions)'
  - gimp (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-27T19:52:36.619548Z'
published: '2026-03-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:50:16.363Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-2271'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-2271'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2438429'
    label: RHBZ#2438429
  - url: 'https://gitlab.gnome.org/GNOME/gimp/-/issues/15732'
tags:
  - cve.org
epss: 0.00513
epssPercentile: 0.43923
ingestedAt: '2026-11-05T22:38:31.410Z'
---

## Overview

A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() function by providing a specially crafted PSP image file. This vulnerability occurs when a 32-bit length value from the file is used for memory allocation without proper validation, leading to a heap overflow and an out-of-bounds write. Successful exploitation could result in an application level denial of service.

## Affected

- `gimp`
- `gimp (all versions)`
- `gimp:2.8/gimp (all versions)`
- `gimp (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.