RHSA-2026:56982: Important: gegl04 security update
GEGL (Generic Graphics Library) is a graph-based image processing framework.Security Fix(es): gimp: GIMP: Arbitrary code execution via heap-based buffer overflow in HDR file parsing (CVE-2026-2050) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gegl04to a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1 - Upgrade
Upgrade
redhat/gegl04-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1 - Upgrade
Upgrade
redhat/gegl04-debugsourceto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1 - Upgrade
Upgrade
redhat/gegl04-devel-docsto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1 - Upgrade
Upgrade
redhat/gegl04-toolsto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1 - Upgrade
Upgrade
redhat/gegl04-tools-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1 - Upgrade
Upgrade
redhat/gegl04to a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1.aa - Upgrade
Upgrade
redhat/gegl04-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1.aa - Upgrade
Upgrade
redhat/gegl04-debugsourceto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1.aa - Upgrade
Upgrade
redhat/gegl04-devel-docsto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1.aa - Upgrade
Upgrade
redhat/gegl04-toolsto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1.aa - Upgrade
Upgrade
redhat/gegl04-tools-debuginfoto a version that resolves this vulnerability.Fixed in 0.4.34-2.el9_2.1.aa
Event History
Frequently Asked Questions
What input would an attacker need to exploit this issue?
The issue is triggered during HDR file parsing. An attacker would need to cause a vulnerable installation to process a malicious HDR image file.
Which installed packages should be checked when determining exposure?
Check for redhat/gegl04 and related packages listed in the advisory: redhat/gegl04-debuginfo, redhat/gegl04-debugsource, redhat/gegl04-devel-docs, redhat/gegl04-tools, and redhat/gegl04-tools-debuginfo.