Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GIMP ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Angriff auszulösen oder vertrauliche Daten offenzulegen.
Product
Das "Gnu Image Manipulation Program" ist eine Open Source Software zum Bearbeiten von Bildern. Es ist auch Bestandteil vieler Linux Distributionen.
Vulnerabilities 5
-
High 7.8
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in th…
-
High 7.8
Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a c…
-
High 7.8
Gimp: gimp: use-after-free in xcf loader via prop_selected_path
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
-
High 7.1
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
-
Medium 5.5
Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application.
Revision history
-
#6
Neue Updates von Amazon aufgenommen
-
#5
Neue Updates von Oracle Linux aufgenommen
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Neue Updates von Oracle Linux aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
GitHub Security Advisory vom 2026-10-19
https://github.com/advisories/GHSA-62RM-W897-WJR7
-
GitHub Security Advisory vom 2026-10-19
https://github.com/advisories/GHSA-Q33M-7RV9-85G4
-
GitHub Security Advisory vom 2026-10-19
https://github.com/advisories/GHSA-CCH8-WX4H-HXQR
-
GitHub Security Advisory vom 2026-10-19
https://github.com/advisories/GHSA-QQ8P-JMJC-FWXX
-
GitHub Security Advisory vom 2026-10-19
https://github.com/advisories/GHSA-C76X-QR78-64HW
-
Red Hat Security Advisory RHSA-2026:93975 vom 2026-11-02
https://access.redhat.com/errata/RHSA-2026:93975
-
Oracle Linux Security Advisory ELSA-2026-93975 vom 2026-11-03
https://linux.oracle.com/errata/ELSA-2026-93975.html
-
Red Hat Security Advisory RHSA-2026:95482 vom 2026-11-05
https://access.redhat.com/errata/RHSA-2026:95482
-
Oracle Linux Security Advisory ELSA-2026-95482 vom 2026-11-05
https://linux.oracle.com/errata/ELSA-2026-95482.html
-
Rocky Linux Security Advisory RLSA-2026:95482 vom 2026-11-06
https://errata.build.resf.org/RLSA-2026:95482
-
Amazon Linux Security Advisory ALAS2GIMP-2026-022 vom 2026-11-09
https://alas.aws.amazon.com/AL2/ALAS2GIMP-2026-022.html