CVE details
CVE-2026-82343
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
Affected ports (3)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| graphics/gimp | gimp | 2.10.38,2 | unaddressed | gnome@FreeBSD.org |
| graphics/gimp-app | gimp-app | 2.10.38_11,1 | unaddressed | gnome@FreeBSD.org |
| graphics/gimp3-app | gimp3-app | 3.2.6 | unaddressed | gnome@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>gimp</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>gimp-app</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>gimp3-app</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A flaw was found in the file-psd plugin in GIMP. When processing a
specially crafted PSD image file, the plugin does not properly
validate the channel-count parameter. This incorrect validation leads
to improper memory bounds checking, resulting in both a heap
out-of-bounds read and a stack out-of-bounds access. This issue can
result in an application crash, leading to a denial of service or a
limited information disclosure of memory contents.</p>
</body>
</description>
<references>
<cvename>CVE-2026-82343</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-82343</url>
</references>
<dates>
<discovery>2026-08-28</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>