Summary
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
Bug Fix(es) and Enhancement(s):
* gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:RHEL-178367)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 23
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | gimp | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
| AlmaLinux · 8 | gimp-devel | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
| AlmaLinux · 8 | gimp-devel-tools | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
| AlmaLinux · 8 | gimp-libs | 2:2.8.22-26.module_el8.10.0+4352+8516153e.10 |
| AlmaLinux · 8 | pygobject2 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux · 8 | pygobject2 | 2.28.7-5.module_el8.10.0+4175+c208a0bf |
| AlmaLinux · 8 | pygobject2 | 2.28.7-5.module_el8.10.0+4137+2d0d25cf |
| AlmaLinux · 8 | pygobject2-codegen | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux · 8 | pygobject2-codegen | 2.28.7-5.module_el8.10.0+4175+c208a0bf |
| AlmaLinux · 8 | pygobject2-devel | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux · 8 | pygobject2-devel | 2.28.7-5.module_el8.10.0+4137+2d0d25cf |
| AlmaLinux · 8 | pygobject2-devel | 2.28.7-5.module_el8.10.0+3952+571e801c |
| AlmaLinux · 8 | pygobject2-doc | 2.28.7-5.module_el8.10.0+4267+35168c80 |
| AlmaLinux · 8 | pygobject2-doc | 2.28.7-5.module_el8.10.0+4137+2d0d25cf |
| AlmaLinux · 8 | pygtk2 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux · 8 | pygtk2-codegen | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux · 8 | pygtk2-devel | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux · 8 | pygtk2-doc | 2.24.0-25.module_el8.9.0+3725+d1441900 |
| AlmaLinux · 8 | python2-cairo | 1.16.3-7.module_el8.10.0+4267+35168c80 |
| AlmaLinux · 8 | python2-cairo | 1.16.3-7.module_el8.10.0+4175+c208a0bf |
| AlmaLinux · 8 | python2-cairo | 1.16.3-7.module_el8.10.0+3952+571e801c |
| AlmaLinux · 8 | python2-cairo-devel | 1.16.3-7.module_el8.10.0+4267+35168c80 |
| AlmaLinux · 8 | python2-cairo-devel | 1.16.3-7.module_el8.10.0+4175+c208a0bf |
Vulnerabilities 2
-
High 7.8
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in th…
-
High 7.8
GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability
GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target m…