RLSA-2026:98532: Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
gimp: gimp: stack buffer overflow in PSD image resource header loader (CVE-2026-119528)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gimpto a version that resolves this vulnerability.Fixed in 2:3.0.4-8.el9_9.6 - Upgrade
Upgrade
rocky-linux/gimp-debuginfoto a version that resolves this vulnerability.Fixed in 2:3.0.4-8.el9_9.6 - Upgrade
Upgrade
rocky-linux/gimp-debugsourceto a version that resolves this vulnerability.Fixed in 2:3.0.4-8.el9_9.6 - Upgrade
Upgrade
rocky-linux/gimp-libsto a version that resolves this vulnerability.Fixed in 2:3.0.4-8.el9_9.6 - Upgrade
Upgrade
rocky-linux/gimp-libs-debuginfoto a version that resolves this vulnerability.Fixed in 2:3.0.4-8.el9_9.6
Event History
Frequently Asked Questions
Which systems are in scope for this update?
The advisory applies to Rocky Linux installations that have gimp, gimp-libs, or the associated debuginfo and debugsource packages installed. The listed CVSS vector indicates local attack access and required user interaction.
What is the potential impact if the flaw is exploited?
The issue is a stack buffer overflow in the PSD image resource header loader. Its CVSS metrics rate confidentiality, integrity, and availability impact as high.
How can I determine whether a system may be affected?
Check whether any of the packages listed in the advisory are installed on the Rocky Linux system. The provided data does not include affected or fixed package version numbers, so it cannot by itself establish whether an installed version is patched.