Critical Security Flaw in GIMP: Heap Buffer Overflow and Integer Overflow Vulnerabilities
Summary
ALSA-2026:50817: Important: gimp security update. Affects gimp versions < 2:3.0.4-4.el9_8.9. Fixed in 2:3.0.4-4.el9_8.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image editing software that provides a comprehensive suite of tools for image manipulation, including support for layers, effects, and multi-level undo. It is widely used for tasks ranging from simple photo editing to complex graphic design. However, recent vulnerabilities have been identified that could compromise the security of users' systems.
Vulnerability Detail
The vulnerabilities in GIMP stem from multiple issues: a heap-buffer-overflow in the APNG loader when the fcTL width exceeds the IHDR width (CVE-2026-42169), an integer overflow in the file-fits plugin leading to a heap-based buffer overflow on crafted FITS images (CVE-2026-66758), and an out-of-bounds read in the file-icns plugin that can cause information disclosure or crashes on crafted ICNS images (CVE-2026-66759). These vulnerabilities can lead to severe consequences, including system crashes, unauthorized access to sensitive information, and potential exploitation by malicious actors.
How To Fix
Minimum fixed version
2:3.0.4-4.el9_8.9
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted or crafted images in GIMP until the update has been applied. This can help mitigate the risk of exploitation through these vulnerabilities.
Conclusion
The recent vulnerabilities in GIMP pose significant risks to users, including potential crashes and unauthorized access to sensitive information. It is crucial for users to update to the latest patched version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for gimp →
FAQ
GIMP is an open-source image manipulation program that provides a wide range of tools for editing and composing images.
The vulnerabilities include a heap-buffer-overflow, an integer overflow leading to a buffer overflow, and an out-of-bounds read that can cause crashes or information disclosure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update GIMP right away, avoid opening untrusted images to reduce the risk of exploitation.
More details can be found on the CVE pages for CVE-2026-42169, CVE-2026-66758, and CVE-2026-66759.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
