A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-022 advisory.

    A flaw was found in GIMP's X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted     XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If     that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer     read uses the unwrapped dimensions and performs an out-of-bounds read on the heap (CWE-125), after integer     overflow in the size calculation (CWE-190). This can crash GIMP or corrupt process memory.
    (CVE-2026-106061)

    A heap-based buffer overflow was found in GIMP's DICOM export plug-in. When exporting an image with     extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and     bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the     undersized buffer (CWE-787), after integer overflow in the allocation size (CVE-2026-106063)

    A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a     fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail     can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially     arbitrary code execution when the victim browses or opens the file. (CVE-2026-112257)

    A flaw was found in GIMP. The PSD plug-in's image resource header loader uses an incorrect destination     size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can     cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
    (CVE-2026-119528)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1390 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-112257:
    A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a     fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail     can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially     arbitrary code execution when the victim browses or opens the file.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_95482 advisory.

    * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)

    Bug Fix(es) and Enhancement(s):

    * gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:Rocky Linux-178367)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794009779 advisory.

  - A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a     fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail     can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially     arbitrary code execution when the victim browses or opens the file. (CVE-2026-112257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794008461 advisory.

  - A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a     fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail     can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially     arbitrary code execution when the victim browses or opens the file. (CVE-2026-112257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794008461 advisory.

  - A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a     fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail     can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially     arbitrary code execution when the victim browses or opens the file. (CVE-2026-112257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:95482 advisory.

    * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)

    Bug Fix(es) and Enhancement(s):

    * gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:Rocky Linux-178367)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2277:01 advisory.

    * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:95482 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)

    Bug Fix(es) and Enhancement(s):

    * gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:RHEL-178367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-95482 advisory.

    - fix CVE-2026-112257
    - modify fix for CVE-2026-4154
    - fix CVE-2026-90947
    - fix CVE-2026-90948
    - fix CVE-2026-92248
    - fix CVE-2026-97185
    - fix CVE-2026-59090
    - fix CVE-2026-18301
    - fix CVE-2026-18303
    - fix CVE-2026-18305
    - fix CVE-2026-18306
    - fix CVE-2026-66758
    - fix CVE-2026-18304
    - fix CVE-2026-18307
    - fix CVE-2026-58380
    - fix CVE-2026-4150
    - fix CVE-2026-4153
    - fix CVE-2026-4154
    - fix CVE-2026-4887
    - fix CVE-2026-0797
    - fix CVE-2026-2044
    - fix CVE-2026-2045
    - fix CVE-2026-2048
    - fix CVE-2025-14422
    - fix CVE-2025-10920
    - fix CVE-2025-10921
    - fix CVE-2025-10922
    - fix CVE-2025-10923
    - fix CVE-2025-10924
    - fix CVE-2025-10925
    - fix CVE-2025-10934
    - fix CVE-2025-5473 (RHEL-95696)
    - fix CVE-2025-48797 (RHEL-93503)
    - fix CVE-2025-48798 (RHEL-93506)

    pygobject2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:95482 advisory.

    * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)


    Bug Fix(es) and Enhancement(s):

      * gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:RHEL-178367)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2255:12 advisory.

    * gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
      * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033)     (CVE-2026-112257)
      * gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels     (CVE-2026-112258)
      * gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
      * gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93975 advisory.

    - fix CVE-2026-106062
    - fix CVE-2026-112257
    - fix CVE-2026-112258
    - fix CVE-2026-112260

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93975 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)

    * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)

    * gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels     (CVE-2026-112258)

    * gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)

    * gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a     fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail     can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially     arbitrary code execution when the victim browses or opens the file. (CVE-2026-112257)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377896	Amazon Linux 2 : gimp (ALASGIMP-2026-022)	Nessus	Amazon Linux Local Security Checks	Local	high
377885	TencentOS Server 3: gimp:2.8 (TSSA-2026:1390)	Nessus	Tencent Local Security Checks	Local	high
377502	Rocky Linux 8 [CIQ] Security Update: gimp / gimp-debuginfo / gimp-debugsource / gimp-devel / etc (crlsa-2026_95482)	Nessus	Rocky Linux Local Security Checks	Local	high
377134	AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2026:1794009779)	Nessus	Alma Linux Local Security Checks	Local	high
377133	AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1794008461)	Nessus	Alma Linux Local Security Checks	Local	high
377130	Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1794008461)	Nessus	Rocky Linux Local Security Checks	Local	high
377022	RockyLinux 8 : gimp:2.8 (RLSA-2026:95482)	Nessus	Rocky Linux Local Security Checks	Local	high
376988	MiracleLinux 8 : gimp:2.8 (AXSA:2026-2277:01)	Nessus	Miracle Linux Local Security Checks	Local	high
376910	RHEL 8 : gimp:2.8 (RHSA-2026:95482)	Nessus	Red Hat Local Security Checks	Local	high
376655	Oracle Linux 8 : gimp:2.8 (ELSA-2026-95482)	Nessus	Oracle Linux Local Security Checks	Local	high
376450	AlmaLinux 8 : gimp:2.8 (ALSA-2026:95482)	Nessus	Alma Linux Local Security Checks	Local	high
376356	MiracleLinux 9 : gimp-3.0.4-4.el9_8.15 (AXSA:2026-2255:12)	Nessus	Miracle Linux Local Security Checks	Local	high
375512	Oracle Linux 9 : gimp (ELSA-2026-93975)	Nessus	Oracle Linux Local Security Checks	Local	high
375300	RHEL 9 : gimp (RHSA-2026:93975)	Nessus	Red Hat Local Security Checks	Local	high
367456	Linux Distros Unpatched Vulnerability : CVE-2026-112257	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-112257

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high