Critical Security Flaw in GIMP: Out-of-Bounds Write and Buffer Overflow Vulnerabilities
Summary
ALSA-2026:75575: Important: gimp security update. Affects gimp versions < 2:3.0.4-4.el9_8.14. Fixed in 2:3.0.4-4.el9_8.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image editing software that offers a wide range of features including image composition, editing, and manipulation tools. It supports various file formats and provides advanced functionalities such as layers, effects, and multi-level undo. However, recent security vulnerabilities have been identified that could potentially compromise the integrity of the software and the safety of user data.
Vulnerability Detail
The vulnerabilities in GIMP stem from multiple issues including out-of-bounds writes and heap-based buffer overflows. Specifically, an out-of-bounds write in the lighting effects plugin can occur when processing a crafted preset file, leading to potential data corruption or arbitrary code execution. Additionally, a heap-based buffer overflow in the ICO loader can be triggered by an integer overflow in embedded PNG dimensions, which may allow attackers to execute malicious code. An integer overflow when generating thumbnail previews for PSD files further exacerbates the risk, as does another out-of-bounds write in the GIMPressionist plugin. These vulnerabilities can lead to severe consequences, including system crashes and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
2:3.0.4-4.el9_8.14
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening untrusted or crafted preset files and PSD files until the software has been updated to the patched version. Regularly monitor for updates and apply them as soon as they become available.
Conclusion
In summary, GIMP has critical vulnerabilities that need immediate attention. Users are encouraged to update to the latest patched version to mitigate risks associated with these security flaws. Regular monitoring and prompt updates are essential for maintaining software security.
See every vulnerability recorded for gimp →
FAQ
GIMP is an open-source image manipulation program that allows users to edit and compose images with a variety of tools and features.
The vulnerabilities include out-of-bounds writes and heap-based buffer overflows that can be exploited via crafted files.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Avoid opening any untrusted files and monitor for updates until you can apply the necessary patches.
Detailed information can be found on the CVE pages linked in the advisory, which provide insights into the impact and technical details of the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
