Critical Remote Code Execution Vulnerability in GIMP Package
Summary
ALSA-2026:4173: Important: gimp security update. Affects gimp versions < 2:3.0.4-1.el9_7.4. Fixed in 2:3.0.4-1.el9_7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image editing software that provides a comprehensive toolbox for image manipulation, including features like layers, effects, and multi-level undo. It is widely used for tasks ranging from photo retouching to image composition. However, recent vulnerabilities have exposed GIMP to significant security risks, particularly concerning file parsing operations that can lead to remote code execution.
Vulnerability Detail
The vulnerabilities in GIMP stem from several critical flaws in its file parsing capabilities. Specifically, issues such as heap-based buffer overflow, uninitialized memory access, and out-of-bounds writes can be exploited by attackers to execute arbitrary code remotely. These vulnerabilities (CVE-2026-0797, CVE-2026-2044, CVE-2026-2045, CVE-2026-2047, CVE-2026-2048) can lead to severe consequences, including unauthorized access to system resources and potential data breaches.
How To Fix
Minimum fixed version
2:3.0.4-1.el9_7.4
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted image files, particularly those in ICNS, PGM, XWD, and ICO formats, until the package is updated.
Conclusion
The recent vulnerabilities in GIMP pose significant security risks, particularly through remote code execution via file parsing flaws. It is crucial for users to update their software to the latest patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gimp →
FAQ
The vulnerabilities are primarily related to file parsing operations that can lead to remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, avoid opening untrusted image files until the vulnerabilities are patched.
The associated CVEs are CVE-2026-0797, CVE-2026-2044, CVE-2026-2045, CVE-2026-2047, and CVE-2026-2048.
For more details, refer to the CVE pages linked in the advisory or the official GIMP documentation.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
