Description
A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | gimp | < 3.0.0 | 3.0.0 |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gimp | 3.0.0~RC1-4 | — |
| Debian 13 | gimp | 3.0.0~RC1-4 | — |
| Debian 12 | gimp | 2.10.34-1+deb12u3 | DSA-5939-1 |
| Debian 11 | gimp | 2.10.22-4+deb11u3 | DLA-4342-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gimp | 2.10.36-3ubuntu0.24.04.1+esm2 | — |
| Ubuntu Pro 22.04 LTS | gimp | 2.10.30-1ubuntu0.1+esm2 | — |
| Ubuntu Pro 20.04 LTS | gimp | 2.10.18-1ubuntu0.1+esm2 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gimp | 2.8.22-1ubuntu0.1~esm2 | — |
| Ubuntu Pro 16.04 LTS | gimp | 2.8.16-1ubuntu1.1+esm2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | gimp +1 | 2:2.99.8-4.el9_6.2 | RHSA-2025:9162 |
| RHEL 8 | gimp +3 | 2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2 | RHSA-2025:9165 |
| RHEL 8 | pygobject2 +3 | 2.28.7-5.module+el8.10.0+22676+becd68d6 | RHSA-2025:9165 |
| RHEL 8 | pygtk2 +3 | 2.24.0-25.module+el8.9.0+21228+8e80d31d | RHSA-2025:9165 |
| RHEL 8 | python2-cairo +2 | 1.16.3-7.module+el8.10.0+22676+becd68d6 | RHSA-2025:9165 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | gimp +1 | 2:2.99.8-4.el9_4.1 | RHSA-2025:9316 |
| RHEL 9.2 E4S | gimp +1 | 2:2.99.8-4.el9_2.1 | RHSA-2025:9314 |
| RHEL 9.0 E4S | gimp +1 | 2:2.99.8-3.el9_0.1 | RHSA-2025:9315 |
| RHEL 8.8 TUS | gimp +3 | 2:2.8.22-26.module+el8.8.0+23318+cec921ba.1 | RHSA-2025:9569 |
| RHEL 8.8 TUS | pygobject2 +3 | 2.28.7-4.module+el8+2760+3d7d61b2 | RHSA-2025:9569 |
| RHEL 8.8 TUS | pygtk2 +3 | 2.24.0-25.module+el8.4.0+9382+ff08b506 | RHSA-2025:9569 |
| RHEL 8.8 TUS | python2-cairo +2 | 1.16.3-6.module+el8+2760+3d7d61b2 | RHSA-2025:9569 |
| RHEL 8.8 E4S | gimp +3 | 2:2.8.22-26.module+el8.8.0+23318+cec921ba.1 | RHSA-2025:9569 |
| RHEL 8.8 E4S | pygobject2 +3 | 2.28.7-4.module+el8+2760+3d7d61b2 | RHSA-2025:9569 |
| RHEL 8.8 E4S | pygtk2 +3 | 2.24.0-25.module+el8.4.0+9382+ff08b506 | RHSA-2025:9569 |
| RHEL 8.8 E4S | python2-cairo +2 | 1.16.3-6.module+el8+2760+3d7d61b2 | RHSA-2025:9569 |
| RHEL 8.6 TUS | gimp +3 | 2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2 | RHSA-2025:9309 |
| RHEL 8.6 TUS | pygobject2 +3 | 2.28.7-4.module+el8+2760+3d7d61b2 | RHSA-2025:9309 |
| RHEL 8.6 TUS | pygtk2 +3 | 2.24.0-25.module+el8.4.0+9382+ff08b506 | RHSA-2025:9309 |
| RHEL 8.6 TUS | python2-cairo +2 | 1.16.3-6.module+el8+2760+3d7d61b2 | RHSA-2025:9309 |
| RHEL 8.6 E4S | gimp +3 | 2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2 | RHSA-2025:9309 |
| RHEL 8.6 E4S | pygobject2 +3 | 2.28.7-4.module+el8+2760+3d7d61b2 | RHSA-2025:9309 |
| RHEL 8.6 E4S | pygtk2 +3 | 2.24.0-25.module+el8.4.0+9382+ff08b506 | RHSA-2025:9309 |
| RHEL 8.6 E4S | python2-cairo +2 | 1.16.3-6.module+el8+2760+3d7d61b2 | RHSA-2025:9309 |
| RHEL 8.6 AUS | gimp +3 | 2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2 | RHSA-2025:9309 |
| RHEL 8.6 AUS | pygobject2 +3 | 2.28.7-4.module+el8+2760+3d7d61b2 | RHSA-2025:9309 |
| RHEL 8.6 AUS | pygtk2 +3 | 2.24.0-25.module+el8.4.0+9382+ff08b506 | RHSA-2025:9309 |
| RHEL 8.6 AUS | python2-cairo +2 | 1.16.3-6.module+el8+2760+3d7d61b2 | RHSA-2025:9309 |
| RHEL 8.4 AUS | gimp +3 | 2:2.8.22-16.module+el8.4.0+23302+04229f42.2 | RHSA-2025:9308 |
| RHEL 8.4 AUS | pygobject2 +3 | 2.28.7-4.module+el8+2760+3d7d61b2 | RHSA-2025:9308 |
| RHEL 8.4 AUS | pygtk2 +3 | 2.24.0-25.module+el8.4.0+9382+ff08b506 | RHSA-2025:9308 |
| RHEL 8.4 AUS | python2-cairo +2 | 1.16.3-6.module+el8+2760+3d7d61b2 | RHSA-2025:9308 |
| RHEL 8.2 AUS | gimp +3 | 2:2.8.22-16.module+el8.2.0+23304+5410b5dc.3 | RHSA-2025:9310 |
| RHEL 8.2 AUS | pygobject2 +3 | 2.28.7-4.module+el8+2760+3d7d61b2 | RHSA-2025:9310 |
| RHEL 8.2 AUS | pygtk2 +3 | 2.24.0-24.module+el8+2760+3d7d61b2 | RHSA-2025:9310 |
| RHEL 8.2 AUS | python2-cairo +2 | 1.16.3-6.module+el8+2760+3d7d61b2 | RHSA-2025:9310 |
| RHEL 7 ELS | gimp +3 | 2:2.8.22-1.el7_9.2 | RHSA-2025:9501 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | gimp +1 | 2:2.99.8-4.el9_6.2 | ALSA-2025:9162 |
| AlmaLinux 8 | gimp +3 | 2:2.8.22-26.module_el8.10.0+4017+5eb23531.2 | ALSA-2025:9165 |
| AlmaLinux 8 | pygobject2 +3 | 2.28.7-5.module_el8.10.0+3952+571e801c | ALSA-2025:9165 |
| AlmaLinux 8 | pygtk2 +3 | 2.24.0-25.module_el8.9.0+3725+d1441900 | ALSA-2025:9165 |
| AlmaLinux 8 | python2-cairo +1 | 1.16.3-7.module_el8.10.0+3952+571e801c | ALSA-2025:9165 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | gimp | 2:2.99.8-4.el9_6.2 | RLSA-2025:9162 |
| Rocky Linux 8 | gimp | 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 | RLSA-2025:9165 |
| Rocky Linux 8 | pygobject2 | 2.28.7-5.module+el8.10.0+1927+52edb5a0 | RLSA-2025:9165 |
| Rocky Linux 8 | pygtk2 | 2.24.0-25.module+el8.9.0+1723+9bc93544 | RLSA-2025:9165 |
| Rocky Linux 8 | python2-pycairo | 1.16.3-7.module+el8.10.0+1927+52edb5a0 | RLSA-2025:9165 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | gimp | 2.10.30-150400.3.20.1 | SUSE-SU-2025:02164-1 |
| SLES 15 SP6 | gimp | 2.10.30-150400.3.20.1 | SUSE-SU-2025:02164-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | gimp | 2.10.30-150400.3.20.1 | SUSE-SU-2025:02164-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | gimp +1 | 2:2.99.8-4.el9_6.2 | ELSA-2025-9162 |
| Oracle Linux 8 | gimp +3 | 2:2.8.22-26.module+el8.10.0+90619+7a8fb7fd.2 | ELSA-2025-9165 |
| Oracle Linux 8 | pygobject2 +3 | 2.28.7-5.module+el8.10.0+90497+ae78887f | ELSA-2025-9165 |
| Oracle Linux 8 | pygtk2 +3 | 2.24.0-25.module+el8.9.0+90151+46a7e4b5 | ELSA-2025-9165 |
| Oracle Linux 8 | python2-cairo +1 | 1.16.3-7.module+el8.10.0+90497+ae78887f | ELSA-2025-9165 |
| Oracle Linux 7 | gimp +3 | 2:2.8.22-1.0.3.el7 | ELSA-2025-9501 |
Advisories 21
- WID-SEC-2025-1144 GIMP: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 5, 2026
- ALSA-2025:9162 Important: gimp security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:9165 Important: gimp:2.8 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:9569 Red Hat Security Advisory: gimp:2.8 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9501 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9315 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9316 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9314 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9310 Red Hat Security Advisory: gimp:2.8 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9308 Red Hat Security Advisory: gimp:2.8 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9309 Red Hat Security Advisory: gimp:2.8 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9162 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:9165 Red Hat Security Advisory: gimp:2.8 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- DSA-5939-1 gimp - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:02164-1 Security update for gimp SUSE / openSUSE Security Updates · Feb 4, 2026
- DLA-4342-1 gimp - security update Debian Security (DSA / DLA) · Oct 22, 2025
- RLSA-2025:9162 Important: gimp security update Rocky Linux Security Advisories · Oct 4, 2025
- RLSA-2025:9165 Important: gimp:2.8 security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-9501 Important: gimp security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 2, 2025
- ELSA-2025-9162 Important: gimp security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 17, 2025
- ELSA-2025-9165 Important: gimp:2.8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 17, 2025
References
- RHSA-2025:9162 vendor-advisory
- RHSA-2025:9165 vendor-advisory
- RHSA-2025:9308 vendor-advisory
- RHSA-2025:9309 vendor-advisory
- RHSA-2025:9310 vendor-advisory
- RHSA-2025:9314 vendor-advisory
- RHSA-2025:9315 vendor-advisory
- RHSA-2025:9316 vendor-advisory
- RHSA-2025:9501 vendor-advisory
- RHSA-2025:9569 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-48797 vdb-entry
- RHBZ#2368558 issue-tracking
- https://gitlab.gnome.org/GNOME/gimp/-/issues/11822