Critical Security Update for GIMP: Out-of-Bounds Write and Buffer Overflow Vulnerabilities
Summary
ALSA-2026:84744: Important: gimp:2.8 security update. Affects gimp versions < 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9. Fixed in 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a widely-used open-source image editing software that offers a comprehensive suite of tools for image manipulation, including support for layers, effects, and multi-level undo. Despite its robust capabilities, GIMP has been found vulnerable to several security issues that could potentially compromise user data and system integrity.
Vulnerability Detail
The vulnerabilities identified in GIMP include an out-of-bounds write in the lighting effects plugin, a heap-based buffer overflow in the ICO loader, and an integer overflow when generating thumbnail previews for PSD files. These vulnerabilities can be exploited by attackers through crafted preset files or malicious image files, leading to potential data corruption, application crashes, or arbitrary code execution.
How To Fix
Minimum fixed version
2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted image files or preset files until the software is updated. It is advisable to use alternative image editing software for sensitive tasks until the vulnerabilities are patched.
Conclusion
In summary, GIMP has critical vulnerabilities that require immediate attention. Users are advised to update their software to the latest patched version to mitigate risks associated with these security flaws. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gimp →
FAQ
The main vulnerabilities include out-of-bounds writes, heap-based buffer overflows, and integer overflows that can be exploited through crafted files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, avoid opening untrusted files and consider using alternative software for image editing.
Yes, exploiting these vulnerabilities could lead to data corruption or loss, making it crucial to update the software promptly.
More information can be found on the CVE pages linked in the advisory, which detail the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
