Critical Security Flaw in GIMP Package: Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:61587: Important: gimp security update. Affects gimp versions < 2:3.0.4-4.el9_8.10. Fixed in 2:3.0.4-4.el9_8.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image composition and editing tool widely used for tasks such as photo retouching, image editing, and graphic design. It features a comprehensive toolbox that includes channel operations, layers, effects, sub-pixel imaging, anti-aliasing, and multi-level undo capabilities. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code through specially crafted image files.
Vulnerability Detail
The vulnerabilities in GIMP stem from improper handling of various image file formats, particularly PSD and TIF files. These issues include unsigned underflows, integer overflows, and heap-based buffer overflows, which can lead to remote code execution. Attackers can exploit these vulnerabilities by crafting malicious image files that, when opened in GIMP, could execute arbitrary code on the user's system, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
2:3.0.4-4.el9_8.10
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening untrusted or unknown image files, particularly those in PSD and TIF formats, until the software is updated to the patched version.
Conclusion
The recent vulnerabilities in GIMP pose significant security risks, allowing for potential arbitrary code execution through crafted image files. Users are strongly encouraged to update their installations to the latest patched version to mitigate these risks and ensure the security of their systems.
See every vulnerability recorded for gimp →
FAQ
The vulnerabilities involve arbitrary code execution due to improper handling of image files, which can be exploited by attackers.
If you are using a version prior to 2:3.0.4-4.el9_8.10, your installation is vulnerable.
Avoid opening any untrusted image files, especially PSD and TIF formats, until you can apply the update.
You can refer to the CVE pages listed in the vulnerability details for in-depth information.
Vulert allows you to monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
