Most recent entries from all

ALSA-2026:40751 — Important: gimp security update

Affected: AlmaLinux:9: gimp, AlmaLinux:9: gimp-libs

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

* gimp: gimp: Stack buffer overflow in pnmscanner_gettoken() (CVE-2026-58380) * gimp: gimp: Integer overflow in read_RLE_channel() (CVE-2026-58384)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-379228

fkie_cve-2026-58384

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

GHSA-pp89-6qxc-wh8f

OESA-2026-3096 — gimp security update

Affected: openEuler:24.03-LTS-SP1: gimp

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute. Security Fix(es):

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.(CVE-2026-58379)

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.(CVE-2026-58380)

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequen…

RHSA-2026:40751 — Red Hat Security Advisory: gimp security update

gimp: gimp: Stack buffer overflow in pnmscanner_gettoken() gimp: gimp: Integer overflow in read_RLE_channel()

RHSA-2026:73768 — Red Hat Security Advisory: gimp security update

gimp: GIMP: Remote code execution via PSD file parsing integer overflow gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow gimp: GIMP: Remote code execution via TIF file parsing vulnerability gimp: GIMP: Arbitrary code execution via crafted TIF file parsing gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c) gimp: gimp: Heap buffer overflow in read_channel_data() gimp: gimp: Stack buffer overflow in pnmscanner_gettoken() gimp: gimp: Integer overflow in read_RLE_channel() gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images

UBUNTU-CVE-2026-58384

Affected: Ubuntu:Pro:16.04:LTS: gimp, Ubuntu:Pro:18.04:LTS: gimp, Ubuntu:Pro:20.04:LTS: gimp, Ubuntu:Pro:22.04:LTS: gimp, Ubuntu:Pro:24.04:LTS: gimp, Ubuntu:25.10: gimp, Ubuntu:26.04:LTS: gimp

WID-SEC-W-2026-2219 — GIMP: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in GIMP ausnutzen, um beliebigen Programmcode auszuführen, und um einen Denial of Service Angriff durchzuführen.