RHSA-2026:98532: Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.Security Fix(es): gimp: gimp: stack buffer overflow in PSD image resource header loader (CVE-2026-119528) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gimpto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6 - Upgrade
Upgrade
redhat/gimp-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6 - Upgrade
Upgrade
redhat/gimp-debugsourceto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6 - Upgrade
Upgrade
redhat/gimp-devel-tools-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6 - Upgrade
Upgrade
redhat/gimp-libsto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6 - Upgrade
Upgrade
redhat/gimp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6 - Upgrade
Upgrade
redhat/gimpto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6.aa - Upgrade
Upgrade
redhat/gimp-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6.aa - Upgrade
Upgrade
redhat/gimp-debugsourceto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6.aa - Upgrade
Upgrade
redhat/gimp-devel-tools-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6.aa - Upgrade
Upgrade
redhat/gimp-libsto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6.aa - Upgrade
Upgrade
redhat/gimp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.4-8.el9_9.6.aa
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
The issue is in GIMP's PSD image resource header loader, so exploitation requires GIMP to process a crafted PSD image containing a malicious image resource header.
Which installed packages are covered by this advisory?
The advisory lists redhat/gimp, redhat/gimp-debuginfo, redhat/gimp-debugsource, redhat/gimp-devel-tools-debuginfo, redhat/gimp-libs, and redhat/gimp-libs-debuginfo.
What vulnerability class is addressed?
This update fixes a stack buffer overflow, classified as CWE Buffer Overflow, tracked as CVE-2026-119528.