RHSA-2026:61587: Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.Security Fix(es): gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow (CVE-2026-59090) gimp: GIMP: Arbitrary code execution via crafted TIF file parsing (CVE-2026-18304) gimp: GIMP: Remote code execution via PSD file parsing integer overflow (CVE-2026-18301) gimp: GIMP: Remote Code Execution via TIF File Parsing Integer Overflow (CVE-2026-18308) gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18302) gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow (CVE-2026-18305) gimp: GIMP: Remote code execution via TIF file parsing vulnerability (CVE-2026-18303) gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow (CVE-2026-18306) gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18307) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gimpto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10 - Upgrade
Upgrade
redhat/gimp-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10 - Upgrade
Upgrade
redhat/gimp-debugsourceto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10 - Upgrade
Upgrade
redhat/gimp-devel-tools-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10 - Upgrade
Upgrade
redhat/gimp-libsto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10 - Upgrade
Upgrade
redhat/gimp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10 - Upgrade
Upgrade
redhat/gimpto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10.aa - Upgrade
Upgrade
redhat/gimp-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10.aa - Upgrade
Upgrade
redhat/gimp-debugsourceto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10.aa - Upgrade
Upgrade
redhat/gimp-devel-tools-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10.aa - Upgrade
Upgrade
redhat/gimp-libsto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10.aa - Upgrade
Upgrade
redhat/gimp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-4.el9_8.10.aa
Event History
Frequently Asked Questions
What input would an attacker need to exploit these issues?
The issues are triggered by parsing crafted image files. Affected formats include PSD, TIF, and SGI files, so exposure occurs when GIMP processes a malicious file in one of those formats.
What is the potential impact if a malicious file is processed?
The listed fixes address arbitrary code execution and remote code execution vulnerabilities. The underlying flaw types include integer overflow, unsigned underflow, and heap-based buffer overflow.
Which Red Hat GIMP packages are in scope for this update?
The advisory lists redhat/gimp, redhat/gimp-libs, redhat/gimp-debuginfo, redhat/gimp-debugsource, redhat/gimp-devel-tools-debuginfo, and redhat/gimp-libs-debuginfo.