Critical Security Flaws in GIMP: Multiple Remote Code Execution Vulnerabilities
Summary
ALSA-2026:19362: Important: gimp security update. Affects gimp versions < 2:3.0.4-4.el9_8.4. Fixed in 2:3.0.4-4.el9_8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image editing tool widely used for tasks such as photo retouching, image composition, and image authoring. It offers a comprehensive suite of features including layers, effects, and multi-level undo capabilities. However, recent vulnerabilities have been identified that could allow attackers to exploit the software through specially crafted image files.
Vulnerability Detail
The vulnerabilities in GIMP stem from improper handling of various image file formats, leading to potential memory disclosure, denial of service, and remote code execution. Specifically, issues have been identified in the parsing of PCX, XPM, ANI, JP2, PSD, and PSP files. Attackers can exploit these vulnerabilities by tricking users into opening malicious files, which could result in arbitrary code execution and significant security risks.
How To Fix
Minimum fixed version
2:3.0.4-4.el9_8.4
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted image files or files from unknown sources until the software is updated to the patched version.
Conclusion
The recent security update for GIMP addresses critical vulnerabilities that could lead to severe security risks. Users are strongly encouraged to update their software to the latest version to protect against potential exploits.
See every vulnerability recorded for gimp →
FAQ
GIMP is an open-source image manipulation program used for editing and composing images.
The vulnerabilities include memory disclosure, denial of service, and remote code execution through various image file formats.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Avoid opening any untrusted or suspicious image files until you can apply the update.
For detailed information, refer to the CVE pages associated with the vulnerabilities listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
