CVE-2026-2239: 
NixOS vulnerability analysis and mitigation

CVE-2026-2239 is a heap-buffer-overflow vulnerability in GIMP's PSD (Photoshop Document) file parser that can cause an application-level Denial of Service. The flaw exists in the fread_pascal_string function within plug-ins/file-psd/psd-util.c, where a buffer allocated for a Pascal string is not null-terminated, leading to an out-of-bounds read when strlen() is subsequently called. It affects GIMP version 3.2.0-rc3 and is also tracked against Red Hat Enterprise Linux 7.0, 8.0, and 9.0. The vulnerability was first reported on February 9, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper null termination (CWE-170) in the fread_pascal_string() function in plug-ins/file-psd/psd-util.c. At line 277, the function allocates a buffer of len bytes using g_malloc(len) and reads len bytes from the file into it, but does not null-terminate the buffer. When this buffer is subsequently passed to gimp_any_to_utf8() at line 302, downstream code calls strlen() on the raw buffer, reading one byte past the end of the allocated region — a heap-buffer-overflow READ. The attack vector is network-adjacent (a user must open a crafted PSD file), requires no privileges, but does require user interaction. A PoC was demonstrated using AddressSanitizer, which confirmed a READ of size 15 at 0 bytes after a 14-byte region, triggering an abort (Red Hat Bugzilla).

Successful exploitation causes GIMP to crash when opening a specially crafted PSD file, resulting in an application-level Denial of Service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The scope is confined to the affected GIMP process; no lateral movement or data exfiltration is possible through this vulnerability alone (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept (PoC) PSD file was included in the original bug report and demonstrated via AddressSanitizer, confirming reproducibility. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability requires user interaction — a victim must open a malicious PSD file — limiting its exploitability (Red Hat Bugzilla, GNOME GitLab).

1. Craft a malicious PSD file: Create a PSD file with a layer whose Pascal string name has a specific length (e.g., 14 bytes) and contains no null byte within those bytes, so that strlen() will read past the end of the allocated buffer.
2. Deliver the file to the target: Send the crafted PSD file to the victim via email, file sharing, or a web download, relying on social engineering to prompt the user to open it in GIMP.
3. Trigger file parsing: The victim opens the file in GIMP (File → Open). GIMP's PSD plugin calls load_image → read_layer_block → read_layer_info → fread_pascal_string.
4. Trigger the heap-buffer-overflow: Inside fread_pascal_string (psd-util.c:277), a 14-byte buffer is allocated without null termination. At line 302, gimp_any_to_utf8 calls g_strdup which calls strlen, reading 15 bytes and overflowing the heap buffer.
5. Application crash: GIMP aborts due to the out-of-bounds read, achieving a Denial of Service against the application (Red Hat Bugzilla).

• File System: Presence of unexpected or unsolicited .psd files in user download directories or email attachments, particularly files with unusual layer name structures.
• Logs: GIMP crash reports or core dumps referencing fread_pascal_string, psd-util.c, or psd-load.c in stack traces; AddressSanitizer output mentioning heap-buffer-overflow in strlen called from gimp_any_to_utf8.
• Process: Unexpected GIMP process termination (crash/abort) immediately after opening a PSD file, especially with no prior stability issues (Red Hat Bugzilla).

Patches have been tracked through Red Hat's Bugzilla system (Bug ID: 2437675) and are available for GIMP and affected Red Hat Enterprise Linux versions (7.0, 8.0, 9.0). The suggested code fix is to allocate len+1 bytes in fread_pascal_string() and set str[len] = '\0' before passing the buffer to gimp_any_to_utf8, or to ensure all callers use the length parameter and never assume null termination. As a workaround, users should avoid opening untrusted or unexpected PSD files from unknown sources. Debian, Fedora, and Amazon Linux 2 have also issued updated packages addressing this vulnerability (Red Hat Bugzilla, Red Hat CVE).

The vulnerability received coverage from Linux security news aggregators including LinuxSecurity.com (Debian DSA-6139-1 advisory), LinuxCompatible.org (Debian and Fedora 43 update coverage), and German security site Pro-Linux.de. Amazon Linux 2 issued advisory ALAS2GIMP-2026-011 addressing the flaw. No notable researcher commentary or significant social media discussion has been identified beyond standard patch notification channels.