Summary
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
* gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c) (CVE-2026-42169)
* gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images (CVE-2026-66758)
* gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted ICNS images (CVE-2026-66759)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | gimp | 2:3.0.4-4.el9_8.9 |
| AlmaLinux · 9 | gimp-libs | 2:3.0.4-4.el9_8.9 |
Vulnerabilities 3
-
High 7.8
Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^3…
-
High 7.3
Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buff…
-
High 7.1
Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a trun…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-42169
-
report
https://access.redhat.com/security/cve/CVE-2026-66758
-
report
https://access.redhat.com/security/cve/CVE-2026-66759
-
report
https://bugzilla.redhat.com/2461725
-
report
https://bugzilla.redhat.com/2507475
-
report
https://bugzilla.redhat.com/2507557
-
advisory
https://errata.almalinux.org/9/ALSA-2026-50817.html