Critical Remote Code Execution Vulnerabilities in GIMP Package
Summary
ALSA-2026:5113: Important: gimp:2.8 security update. Affects gimp versions < 2:2.8.22-26.module_el8.10.0+4137+2d0d25cf.5. Fixed in 2:2.8.22-26.module_el8.10.0+4137+2d0d25cf.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image editing software that provides a comprehensive suite of tools for image manipulation, including support for various file formats, layers, effects, and advanced editing capabilities. It is widely used by graphic designers, photographers, and artists for its versatility and extensive features. However, recent security assessments have revealed multiple vulnerabilities in GIMP that could potentially allow attackers to execute arbitrary code remotely, posing significant risks to users.
Vulnerability Detail
The vulnerabilities identified in GIMP stem from improper handling of certain file formats, specifically PGM, XWD, and ICO files. These issues include remote code execution via uninitialized memory in PGM file parsing, out-of-bounds writes in XWD file parsing, and vulnerabilities in ICO file parsing. If exploited, these vulnerabilities could allow an attacker to execute arbitrary code on the victim's machine, leading to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
2:2.8.22-26.module_el8.10.0+4137+2d0d25cf.5
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted files in GIMP until the software is updated. Additionally, consider using alternative image editing software that does not exhibit these vulnerabilities.
Conclusion
The recent vulnerabilities in GIMP highlight the importance of keeping software up to date to protect against potential security threats. By updating to the latest version, users can safeguard their systems from the risks associated with remote code execution vulnerabilities.
See every vulnerability recorded for gimp →
FAQ
GIMP is an open-source image manipulation program that offers a wide range of tools for editing and composing images.
The vulnerabilities could allow attackers to execute arbitrary code on a user's machine, potentially leading to unauthorized access and data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, avoid opening untrusted files in GIMP and consider using alternative software until the vulnerabilities are patched.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
