Summary
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
* gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
* gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
* gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
* gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | gimp | 2:3.0.4-4.el9_8.15 |
| AlmaLinux · 9 | gimp-libs | 2:3.0.4-4.el9_8.15 |
Vulnerabilities 5
-
High 7.8
Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small fo…
-
High 7.8
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in th…
-
High 7.8
Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a c…
-
High 7.8
Gimp: gimp: use-after-free in xcf loader via prop_selected_path
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
-
High 7.1
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
References
-
report
https://access.redhat.com/security/cve/CVE-2026-106062
-
report
https://access.redhat.com/security/cve/CVE-2026-112257
-
report
https://access.redhat.com/security/cve/CVE-2026-112258
-
report
https://access.redhat.com/security/cve/CVE-2026-112260
-
report
https://access.redhat.com/security/cve/CVE-2026-112261
-
report
https://bugzilla.redhat.com/2546654
-
report
https://bugzilla.redhat.com/2555574
-
report
https://bugzilla.redhat.com/2555588
-
report
https://bugzilla.redhat.com/2555730
-
report
https://bugzilla.redhat.com/2555748
-
advisory
https://errata.almalinux.org/9/ALSA-2026-93975.html