CVE-2026-2271: 
NixOS vulnerability analysis and mitigation

CVE-2026-2271 is an integer overflow vulnerability in GIMP's PSP (Paint Shop Pro) file parser that can lead to a heap overflow and application-level denial of service. The flaw exists in the read_creator_block() function within plug-ins/common/file-psp.c, where a 32-bit length value read from a crafted PSP image file is used directly for memory allocation without validation. The confirmed affected version is GIMP 3.2.0-rc2. It was first reported on February 10, 2026, and published to NVD on March 26, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in read_creator_block() in GIMP's PSP file parser. When a PSP file contains a Creator metadata block with a 32-bit length field set to 0xFFFFFFFF, the code computes g_malloc(length + 1), which wraps around to g_malloc(0), allocating a minimal buffer. A subsequent fread() then attempts to read approximately 4 GB of data into this tiny buffer, causing a heap overflow, followed by an out-of-bounds write when string[0xFFFFFFFF] = '\0' is executed. Exploitation requires local access and user interaction — specifically, a victim must open a specially crafted PSP image file. A proof-of-concept harness and malicious PSP file were included in the original bug report, demonstrating the crash under AddressSanitizer on GIMP 3.2.0-rc2 (Red Hat Bugzilla, GNOME GitLab).

Successful exploitation results in an application-level denial of service, causing GIMP to crash or become unresponsive when processing a malicious PSP file. There is no confidentiality or integrity impact — the vulnerability does not expose sensitive data or allow unauthorized modification of files. The scope is limited to the GIMP process itself, with no evidence of lateral movement potential or privilege escalation (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept exploit (crafted PSP file and C harness) is publicly available via the Red Hat Bugzilla report, demonstrating the crash under AddressSanitizer. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.055% (0.000550), reflecting low probability of active exploitation. Exploitation requires user interaction (opening a malicious file) and local access, limiting its practical attack surface (Red Hat Bugzilla, GNOME GitLab).

1. Craft a malicious PSP file: Create a PSP image file with a Creator metadata block containing a ~FL keyword chunk where the 32-bit length field is set to 0xFFFFFFFF. The PoC command from the bug report generates such a file:

   printf 'Paint Shop Pro Image File\n\x1a\0...~FL\0\0\0\xff\xff\xff\xff%s' "$(printf 'A%.0s' {1..256})" > psp_overflow.psp

2. Deliver the file to the target: Send the crafted .psp file to the victim via email, file share, or web download, relying on social engineering to prompt the user to open it in GIMP.
3. Trigger parsing: When the victim opens the file in GIMP 3.2.0-rc2, the PSP file parser invokes read_creator_block(), which reads the 0xFFFFFFFF length value from the file.
4. Trigger integer overflow: The code executes g_malloc(0xFFFFFFFF + 1), which wraps to g_malloc(0), allocating a near-zero-sized buffer.
5. Heap overflow and crash: fread() attempts to read ~4 GB into the tiny buffer, causing a heap overflow; the subsequent string[0xFFFFFFFF] = '\0' write triggers an out-of-bounds write, crashing the application (Red Hat Bugzilla).

• File System: Presence of unexpected .psp files in user download directories or email attachments, particularly files with anomalously large Creator block length fields.
• Process: GIMP process terminating abnormally (segmentation fault or abort signal) immediately after opening a .psp file; crash dumps or core files generated by the GIMP process.
• Logs: System crash logs (e.g., /var/log/syslog, journalctl) showing GIMP process killed with SIGSEGV or SIGABRT after opening a PSP file; AddressSanitizer output referencing read_creator_block() in file-psp.c if GIMP was compiled with sanitizers.

Update GIMP to a patched version that addresses the integer overflow in the PSP file parser; patches were made available and tracked via Red Hat Bugzilla (bug 2438429) and the GNOME GitLab issue tracker. Downstream Linux distributions including Debian (DSA-6139-1, DLA-4483-1) and Amazon Linux 2 (ALAS2GIMP-2026-011) have released updated packages. As a workaround, restrict users from opening untrusted PSP image files, or configure file type restrictions to block .psp files in environments where GIMP is used for processing untrusted content (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was reported by Red Hat's OSIDB team and tracked through standard coordinated disclosure channels. Downstream distributions including Debian and Amazon Linux issued security advisories promptly after the fix became available. No notable public researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries and Linux security advisory aggregators.