Hi,
The following vulnerability was published for gimp.
CVE-2026-90949[0]:
| A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When
| processing a compressed selection channel, a heap-based buffer
| overflow can occur due to a mismatch between the allocated buffer
| size and the amount of data decompressed. A remote attacker could
| exploit this vulnerability by crafting a malicious PSP file. Opening
| this file in GIMP could lead to a crash or arbitrary code execution.
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16753
https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2998
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/0ff8049449b00bdd906faad7fcea091de8aa00a5
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-90949
https://www.cve.org/CVERecord?id=CVE-2026-90949
Please adjust the affected versions in the BTS as needed.