A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789142941 advisory.

  - A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the     plugin validates the image width and bytes-per-line parameters independently rather than ensuring their     combined values are consistent with the allocated buffer size. This incorrect validation leads to improper     bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading     to a denial of service or a limited information disclosure of heap memory contents into the produced     image. (CVE-2026-80101)

  - A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the     plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper     memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This     issue can result in an application crash, leading to a denial of service or a limited information     disclosure of memory contents. (CVE-2026-82343)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789144988 advisory.

  - A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the     plugin validates the image width and bytes-per-line parameters independently rather than ensuring their     combined values are consistent with the allocated buffer size. This incorrect validation leads to improper     bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading     to a denial of service or a limited information disclosure of heap memory contents into the produced     image. (CVE-2026-80101)

  - A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the     plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper     memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This     issue can result in an application crash, leading to a denial of service or a limited information     disclosure of memory contents. (CVE-2026-82343)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789144988 advisory.

  - A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the     plugin validates the image width and bytes-per-line parameters independently rather than ensuring their     combined values are consistent with the allocated buffer size. This incorrect validation leads to improper     bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading     to a denial of service or a limited information disclosure of heap memory contents into the produced     image. (CVE-2026-80101)

  - A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the     plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper     memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This     issue can result in an application crash, leading to a denial of service or a limited information     disclosure of memory contents. (CVE-2026-82343)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-020 advisory.

    GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required     to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

    The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper     validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-29395. (CVE-2026-18301)

    GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is     required to exploit this vulnerability in that the target must visit a malicious page or open a malicious     file.

    The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper     validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker     can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29399.
    (CVE-2026-18303)

    GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required     to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

    The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper     validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-29406. (CVE-2026-18305)

    A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the     plugin validates the image width and bytes-per-line parameters independently rather than ensuring their     combined values are consistent with the allocated buffer size. This incorrect validation leads to improper     bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading     to a denial of service, or a limited information disclosure of heap memory contents into the produced     image. (CVE-2026-80101)

    A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the     plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads     to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an     application crash, leading to a denial of service or a limited information disclosure of heap memory     contents. (CVE-2026-82328)

    A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the     plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper     memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This     issue can result in an application crash, leading to a denial of service or a limited information     disclosure of memory contents. (CVE-2026-82343)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the     plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper     memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This     issue can result in an application crash, leading to a denial of service or a limited information     disclosure of memory contents. (CVE-2026-82343)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
361716	AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789142941)	Nessus	Alma Linux Local Security Checks	Local	medium
360554	AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789144988)	Nessus	Alma Linux Local Security Checks	Local	medium
360067	Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789144988)	Nessus	Rocky Linux Local Security Checks	Local	medium
345809	Amazon Linux 2 : gimp (ALASGIMP-2026-020)	Nessus	Amazon Linux Local Security Checks	Local	high
341353	Linux Distros Unpatched Vulnerability : CVE-2026-82343	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-82343

medium

Tenable Plugins

medium

medium

medium

high

medium