Summary
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
Bug Fix(es) and Enhancement(s):
* gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:Rocky Linux-178367)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+40407+12f45184.10 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 |
| Rocky Linux · 8 | gimp | 2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9 |
| Rocky Linux · 8 | pygobject2 | 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 |
| Rocky Linux · 8 | pygtk2 | 0:2.24.0-25.module+el8.9.0+1723+9bc93544 |
| Rocky Linux · 8 | python2-pycairo | 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 |
Vulnerabilities 1
-
High 7.8
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in th…