Red Hat Security Advisory

RHSA-2026:80509

gimp security update

Released 2026-10-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.4) gimp-2:2.99.8-4.el9_4.19, gimp-libs-2:2.99.8-4.el9_4.19

Fixes 13 records

TI-2026-42270 CVE-2026-59090 · GHSA-gfh5-q868-q4pw

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

HIGH 76

A flaw was found in GIMP's PSD file format plugin.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0076 Published 2026-08-10 Partial fix · 2:3.0.4-4.el9_8.10, 2:2.99.8-4.el9_2.7 +2 CWE-191

TI-2026-47406 CVE-2026-66758 · GHSA-p2xc-g3qc-p2mq

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

LOW 36

A flaw was found in the file-fits plugin in GIMP.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00296 Published 2026-07-27 Partial fix · 8100020260824165450.4c9c024f, 2:3.0.4-4.el9_8.9 +3 CWE-190

TI-2026-42013 CVE-2026-58384 · GHSA-pp89-6qxc-wh8f

Gimp: gimp: integer overflow in read_rle_channel()

LOW 36

A flaw was found in GIMP's PSD parser.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00305 Published 2026-07-07 Fixed in 2:3.0.4-4.el9_8.7, 2:2.99.8-4.el9_2.7 +2 CWE-190

TI-2026-42011 CVE-2026-58380 · GHSA-c7fj-r3pq-5ph5

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

LOW 36

A flaw was found in GIMP's PNM file format parser.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00318 Published 2026-07-06 Partial fix · 8100020260824165450.4c9c024f, 2:3.0.4-4.el9_8.7 +3 CWE-193

TI-2026-15060 CVE-2026-18307 · GHSA-3pr5-5prq-x75c

Heap-based buffer overflow in GIMP

LOW 36

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00423 Published 2026-08-20 Partial fix CWE-122

TI-2026-15059 CVE-2026-18306 · GHSA-7pm3-57j9-653g

Integer overflow in GIMP

LOW 36

GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00339 Published 2026-08-20 Partial fix CWE-190

TI-2026-15058 CVE-2026-18305 · GHSA-7qjq-qhff-chm9

Integer overflow in GIMP

LOW 36

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00359 Published 2026-08-20 Partial fix CWE-190

TI-2026-15057 CVE-2026-18304 · GHSA-2pp7-5fqx-5xcq

Integer overflow in GIMP

LOW 36

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00359 Published 2026-08-20 Partial fix CWE-190

TI-2026-15056 CVE-2026-18303 · GHSA-5g2q-9q4q-p55m

Stack-based buffer overflow in GIMP

LOW 36

GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00389 Published 2026-08-20 Partial fix CWE-121

TI-2026-15055 CVE-2026-18302 · GHSA-5gmv-r46m-x6rr

Heap-based buffer overflow in GIMP

LOW 36

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00389 Published 2026-08-20 Partial fix CWE-122

TI-2026-15054 CVE-2026-18301 · GHSA-282j-q335-6rxf

Integer overflow in GIMP

LOW 36

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00339 Published 2026-08-20 Partial fix CWE-190

TI-2026-30495 CVE-2026-42169 · GHSA-xq2c-w9r3-rwr6

Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)

LOW 35

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00133 Published 2026-08-04 Fixed in 2:3.0.4-4.el9_8.9, 2:2.99.8-4.el9_2.7 +2 CWE-131

TI-2026-42010 CVE-2026-58379 · GHSA-rx3j-28q8-xw3m

Gimp: gimp: heap buffer overflow in read_channel_data()

LOW 34

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00471 Published 2026-07-03 Fixed in 2:3.0.4-4.el9_8.5, 2:2.99.8-4.el9_2.7 +2 CWE-122