RLSA-2026:95482: Important: gimp:2.8 security, bug fix, and enhancement update

Q: Which systems should be prioritized for review?

Systems running Rocky Linux packages named gimp, pygobject2, pygtk2, or python2-pycairo are included in this update. The security fix specifically concerns GIMP's PSD thumbnail loader.

Q: What processing path is associated with the vulnerability?

The issue is a heap out-of-bounds read/write in the PSD thumbnail loader, identified as load_resource_1033. Environments where GIMP handles PSD files or generates PSD thumbnails are the relevant exposure path described by the advisory.

Q: Can this advisory be used to determine whether an installed system is still vulnerable?

No fixed or affected package versions are provided in the advisory data. Check whether the listed Rocky Linux packages are installed and compare their installed versions with the package versions supplied by the Rocky Linux update.

Published Nov 6, 2026

Updated

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (loadresource1033) (CVE-2026-112257)

Bug Fix(es) and Enhancement(s):

gimp: xpm poc file for CVE-2026-4154 should error differently (JIRA:Rocky Linux-178367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

12 affected componentsFixes available

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+1927+52edb5a0

2:2.8.22-26.module+el8.10.0+1927+52edb5a0

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2

2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+40134+eab491b1.5

2:2.8.22-26.module+el8.10.0+40134+eab491b1.5

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+40407+12f45184.10

2:2.8.22-26.module+el8.10.0+40407+12f45184.10

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8

2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+40033+6fd27379.3

2:2.8.22-26.module+el8.10.0+40033+6fd27379.3

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6

2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+40075+a21479b4.4

2:2.8.22-26.module+el8.10.0+40075+a21479b4.4

rocky-linux/gimp<2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9

2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9

rocky-linux/pygobject2<0:2.28.7-5.module+el8.10.0+1927+52edb5a0

0:2.28.7-5.module+el8.10.0+1927+52edb5a0

rocky-linux/pygtk2<0:2.24.0-25.module+el8.9.0+1723+9bc93544

0:2.24.0-25.module+el8.9.0+1723+9bc93544

rocky-linux/python2-pycairo<0:1.16.3-7.module+el8.10.0+1927+52edb5a0

0:1.16.3-7.module+el8.10.0+1927+52edb5a0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+1927+52edb5a0
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+40407+12f45184.10
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4
Upgrade
Upgrade rocky-linux/gimp to a version that resolves this vulnerability.
Fixed in 2:2.8.22-26.module+el8.10.0+40380+6ffe857b.9
Upgrade
Upgrade rocky-linux/pygobject2 to a version that resolves this vulnerability.
Fixed in 0:2.28.7-5.module+el8.10.0+1927+52edb5a0
Upgrade
Upgrade rocky-linux/pygtk2 to a version that resolves this vulnerability.
Fixed in 0:2.24.0-25.module+el8.9.0+1723+9bc93544
Upgrade
Upgrade rocky-linux/python2-pycairo to a version that resolves this vulnerability.
Fixed in 0:1.16.3-7.module+el8.10.0+1927+52edb5a0

Event History

Nov 6, 2026

Advisory Published

via OSV·12:01 PM

Data Sourced

via OSV·12:01 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-112257

Frequently Asked Questions

Which systems should be prioritized for review?

Systems running Rocky Linux packages named gimp, pygobject2, pygtk2, or python2-pycairo are included in this update. The security fix specifically concerns GIMP's PSD thumbnail loader.

What processing path is associated with the vulnerability?

The issue is a heap out-of-bounds read/write in the PSD thumbnail loader, identified as load_resource_1033. Environments where GIMP handles PSD files or generates PSD thumbnails are the relevant exposure path described by the advisory.

Can this advisory be used to determine whether an installed system is still vulnerable?

No fixed or affected package versions are provided in the advisory data. Check whether the listed Rocky Linux packages are installed and compare their installed versions with the package versions supplied by the Rocky Linux update.

RLSA-2026:95482: Important: gimp:2.8 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems should be prioritized for review?

What processing path is associated with the vulnerability?

Can this advisory be used to determine whether an installed system is still vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for review?

What processing path is associated with the vulnerability?

Can this advisory be used to determine whether an installed system is still vulnerable?