Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute ar…

published 2009-11-19 16 y ago modified 2026-06-16 4 mo ago also EUVD-2009-3880

cvss: 9.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 8.7%; EPSS 8.7% chance of exploitation in 30 days, percentile 95%
public exploits: 0; none known

Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.

Patch / fix

distros 2 links 2

debian red hat

gimp Debian 14, Debian 13, Debian 12 2.6.7-1.1

debian advisories DEBIAN-CVE-2009-3909

gimp RHEL 5 2:2.2.13-2.0.7.el5_8.5
gimp-libs RHEL 5 2:2.2.13-2.0.7.el5_8.5

red hat advisories RHSA-2012:1181

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-3909 updated 2026-11-05 cvss 6.8

Gimp: Integer overflow in the PSD image file plugin

Red Hat Enterprise Linux 4 gimp
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux (v. 5 server) gimp 2.2.13-2.0.7.el5_8.5, gimp-libs 2.2.13-2.0.7.el5_8.5 Red Hat Enterprise Linux Desktop (v. 5 client) gimp 2.2.13-2.0.7.el5_8.5, gimp-libs 2.2.13-2.0.7.el5_8.5 Red Hat RHEL Desktop Workstation (v. 5 client) gimp 2.2.13-2.0.7.el5_8.5
fixed: vendor fix RHSA-2012:1181
Red Hat Enterprise Linux 6 gimp, gimp-libs, gimp-devel-tools, gimp-help-browser
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

8.69% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

References

git.gnome.org /cgit/gimp/commit/?id=9cc8d78ff33b7a36852b74e64b427489cad44d0e
patch, vendor-advisory
git.gnome.org /cgit/gimp/commit/?id=0e440cb6d4d6ee029667363d244aff61b154c33c
patch, vendor-advisory
debian.org /security/2009/dsa-1941
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/glsa-201209-23.xml
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2012-1181.html
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2010-04/msg00002.html
vendor-advisory, third-party-advisory
mandriva.com /security/advisories?name=MDVSA-2009:332
vendor-advisory, broken-link
vupen.com /english/advisories/2009/3270
vdb-entry, broken-link, vendor-advisory
osvdb.org /60178
vdb-entry, broken-link
secunia.com /secunia_research/2009-43/
broken-link
bugzilla.gnome.org /show_bug.cgi?id=600741
issue-tracking, third-party-advisory
securityfocus.com /archive/1/507928/100/0/threaded
mailing-list, broken-link, third-party-advisory, vdb-entry
securityfocus.com /bid/37040
vdb-entry, broken-link, third-party-advisory
secunia.com /advisories/50737
third-party-advisory, broken-link
vupen.com /english/advisories/2010/1021
vdb-entry, broken-link
secunia.com /advisories/37348
third-party-advisory, broken-link

Sources

CVE List CVE-2009-3909
NVD CVE-2009-3909

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary