ALSA-2026:93975: Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062) gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (loadresource1033) (CVE-2026-112257) gimp: gimp: use-after-free in XCF loader via PROPLINKED and PROPSELECTION on channels (CVE-2026-112258) gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260) gimp: gimp: use-after-free in XCF loader via PROPSELECTEDPATH (CVE-2026-112261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/gimpto a version that resolves this vulnerability.Fixed in 2:3.0.4-4.el9_8.15 - Upgrade
Upgrade
almalinux/gimp-libsto a version that resolves this vulnerability.Fixed in 2:3.0.4-4.el9_8.15
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Who is exposed to these issues?
Users or systems that open untrusted DDS, PSD, or XCF image files with GIMP are exposed. The affected code paths are the DDS loader, PSD thumbnail loader, and XCF loader and text-layer parsing.
What does an attacker need to exploit these vulnerabilities?
An attacker would need to provide a crafted image file in one of the affected formats and have it opened by GIMP. The advisory identifies crafted DirectDraw Surface files for the DDS issue and malformed content processed by PSD or XCF loaders for the other issues.
How can I determine whether I may already be affected?
Review whether GIMP has opened DDS, PSD, or XCF files from untrusted sources, particularly files received through downloads, email, shared storage, or other external channels. The provided advisory does not include indicators of compromise or file signatures for detecting exploitation.