REDHAT-BUG-2459780: Medium severity GIMP vulnerability

Published Apr 20, 2026

Updated

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

Affected Software

1 affected component

GIMP

Event History

Apr 20, 2026

Data Sourced

via Red Hat·04:47 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2459780?

The severity of REDHAT-BUG-2459780 is medium, with a score of 4.

How do I fix REDHAT-BUG-2459780?

To fix REDHAT-BUG-2459780, update GIMP to the latest version that addresses this vulnerability.

What software is affected by REDHAT-BUG-2459780?

GIMP is the software affected by REDHAT-BUG-2459780.

What type of vulnerability is REDHAT-BUG-2459780?

REDHAT-BUG-2459780 is a heap-based out-of-bounds write vulnerability in the decode_lzss() function.

How can an attacker exploit REDHAT-BUG-2459780?

An attacker can exploit REDHAT-BUG-2459780 by tricking a user into opening a specially crafted PAA image file.