Vulnerability-Lookup

RHSA-2026:93975

Vulnerability from csaf_opensuse - Published: 2026-11-02 17:58 - Updated: 2026-11-06 05:39

Summary

Red Hat Security Advisory: gimp security update

Severity

Important

Notes

Topic: An update for gimp is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062) * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257) * gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258) * gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260) * gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-106062

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Fixed 24 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-112257

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Fixed 24 products, the same list as for CVE-2026-106062

Threats

Impact Important

CVE-2026-112258

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 24 products, the same list as for CVE-2026-106062

Threats

Impact Important

CVE-2026-112260

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 24 products, the same list as for CVE-2026-106062

Threats

Impact Important

CVE-2026-112261

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 24 products, the same list as for CVE-2026-106062

Threats

Impact Important

References

28 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:93975	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2546654	external
https://bugzilla.redhat.com/show_bug.cgi?id=2555574	external
https://bugzilla.redhat.com/show_bug.cgi?id=2555588	external
https://bugzilla.redhat.com/show_bug.cgi?id=2555730	external
https://bugzilla.redhat.com/show_bug.cgi?id=2555748	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-106062	self
https://bugzilla.redhat.com/show_bug.cgi?id=2546654	external
https://www.cve.org/CVERecord?id=CVE-2026-106062	external
https://nvd.nist.gov/vuln/detail/CVE-2026-106062	external
https://access.redhat.com/security/cve/CVE-2026-112257	self
https://bugzilla.redhat.com/show_bug.cgi?id=2555574	external
https://www.cve.org/CVERecord?id=CVE-2026-112257	external
https://nvd.nist.gov/vuln/detail/CVE-2026-112257	external
https://access.redhat.com/security/cve/CVE-2026-112258	self
https://bugzilla.redhat.com/show_bug.cgi?id=2555588	external
https://www.cve.org/CVERecord?id=CVE-2026-112258	external
https://nvd.nist.gov/vuln/detail/CVE-2026-112258	external
https://access.redhat.com/security/cve/CVE-2026-112260	self
https://bugzilla.redhat.com/show_bug.cgi?id=2555730	external
https://www.cve.org/CVERecord?id=CVE-2026-112260	external
https://nvd.nist.gov/vuln/detail/CVE-2026-112260	external
https://access.redhat.com/security/cve/CVE-2026-112261	self
https://bugzilla.redhat.com/show_bug.cgi?id=2555748	external
https://www.cve.org/CVERecord?id=CVE-2026-112261	external
https://nvd.nist.gov/vuln/detail/CVE-2026-112261	external

Acknowledgments

Jim Alves-Foss

Alexey Khairov (codem4ster) Nikolay Kravtsov (Kolya080808) Konstantin Talgarenko (Marcusov)

Alexey Khairov (codem4ster, dedicated to Diana) Nikolay Kravtsov (Kolya080808, dedicated to Nonna) Konstantin Talgarenko (Marcusov, dedicated to Karina)

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for gimp is now available for Red Hat Enterprise Linux 9.8 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.\n\nSecurity Fix(es):\n\n* gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)\n\n* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)\n\n* gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)\n\n* gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)\n\n* gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:93975",
        "url": "https://access.redhat.com/errata/RHSA-2026:93975"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2546654",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546654"
      },
      {
        "category": "external",
        "summary": "2555574",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555574"
      },
      {
        "category": "external",
        "summary": "2555588",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555588"
      },
      {
        "category": "external",
        "summary": "2555730",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555730"
      },
      {
        "category": "external",
        "summary": "2555748",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555748"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93975.json"
      }
    ],
    "title": "Red Hat Security Advisory: gimp security update",
    "tracking": {
      "current_release_date": "2026-11-06T05:39:03+00:00",
      "generator": {
        "date": "2026-11-06T05:39:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:93975",
      "initial_release_date": "2026-11-02T17:58:42+00:00",
      "revision_history": [
        {
          "date": "2026-11-02T17:58:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-02T17:58:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-06T05:39:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gimp-2:3.0.4-4.el9_8.15.ppc64le",
                "product": {
                  "name": "gimp-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_id": "gimp-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp@3.0.4-4.el9_8.15?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
                "product": {
                  "name": "gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_id": "gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs@3.0.4-4.el9_8.15?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
                "product": {
                  "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_id": "gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debugsource@3.0.4-4.el9_8.15?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                "product": {
                  "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_id": "gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debuginfo@3.0.4-4.el9_8.15?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                "product": {
                  "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_id": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-devel-tools-debuginfo@3.0.4-4.el9_8.15?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                "product": {
                  "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_id": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs-debuginfo@3.0.4-4.el9_8.15?arch=ppc64le\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gimp-2:3.0.4-4.el9_8.15.src",
                "product": {
                  "name": "gimp-2:3.0.4-4.el9_8.15.src",
                  "product_id": "gimp-2:3.0.4-4.el9_8.15.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp@3.0.4-4.el9_8.15?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gimp-2:3.0.4-4.el9_8.15.aarch64",
                "product": {
                  "name": "gimp-2:3.0.4-4.el9_8.15.aarch64",
                  "product_id": "gimp-2:3.0.4-4.el9_8.15.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp@3.0.4-4.el9_8.15?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
                "product": {
                  "name": "gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
                  "product_id": "gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs@3.0.4-4.el9_8.15?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
                "product": {
                  "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
                  "product_id": "gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debugsource@3.0.4-4.el9_8.15?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                "product": {
                  "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                  "product_id": "gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debuginfo@3.0.4-4.el9_8.15?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                "product": {
                  "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                  "product_id": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-devel-tools-debuginfo@3.0.4-4.el9_8.15?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                "product": {
                  "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                  "product_id": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs-debuginfo@3.0.4-4.el9_8.15?arch=aarch64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gimp-2:3.0.4-4.el9_8.15.x86_64",
                "product": {
                  "name": "gimp-2:3.0.4-4.el9_8.15.x86_64",
                  "product_id": "gimp-2:3.0.4-4.el9_8.15.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp@3.0.4-4.el9_8.15?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
                "product": {
                  "name": "gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
                  "product_id": "gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs@3.0.4-4.el9_8.15?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
                "product": {
                  "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
                  "product_id": "gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debugsource@3.0.4-4.el9_8.15?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                "product": {
                  "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                  "product_id": "gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debuginfo@3.0.4-4.el9_8.15?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                "product": {
                  "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                  "product_id": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-devel-tools-debuginfo@3.0.4-4.el9_8.15?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                "product": {
                  "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                  "product_id": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs-debuginfo@3.0.4-4.el9_8.15?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gimp-libs-2:3.0.4-4.el9_8.15.i686",
                "product": {
                  "name": "gimp-libs-2:3.0.4-4.el9_8.15.i686",
                  "product_id": "gimp-libs-2:3.0.4-4.el9_8.15.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs@3.0.4-4.el9_8.15?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
                "product": {
                  "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
                  "product_id": "gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debugsource@3.0.4-4.el9_8.15?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
                "product": {
                  "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
                  "product_id": "gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-debuginfo@3.0.4-4.el9_8.15?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
                "product": {
                  "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
                  "product_id": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-devel-tools-debuginfo@3.0.4-4.el9_8.15?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
                "product": {
                  "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
                  "product_id": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gimp-libs-debuginfo@3.0.4-4.el9_8.15?arch=i686\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-2:3.0.4-4.el9_8.15.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64"
        },
        "product_reference": "gimp-2:3.0.4-4.el9_8.15.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-2:3.0.4-4.el9_8.15.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le"
        },
        "product_reference": "gimp-2:3.0.4-4.el9_8.15.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-2:3.0.4-4.el9_8.15.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src"
        },
        "product_reference": "gimp-2:3.0.4-4.el9_8.15.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-2:3.0.4-4.el9_8.15.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64"
        },
        "product_reference": "gimp-2:3.0.4-4.el9_8.15.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64"
        },
        "product_reference": "gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686"
        },
        "product_reference": "gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le"
        },
        "product_reference": "gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        },
        "product_reference": "gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64"
        },
        "product_reference": "gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686"
        },
        "product_reference": "gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le"
        },
        "product_reference": "gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64"
        },
        "product_reference": "gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64"
        },
        "product_reference": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686"
        },
        "product_reference": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le"
        },
        "product_reference": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        },
        "product_reference": "gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-2:3.0.4-4.el9_8.15.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64"
        },
        "product_reference": "gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-2:3.0.4-4.el9_8.15.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686"
        },
        "product_reference": "gimp-libs-2:3.0.4-4.el9_8.15.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-2:3.0.4-4.el9_8.15.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le"
        },
        "product_reference": "gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-2:3.0.4-4.el9_8.15.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64"
        },
        "product_reference": "gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64"
        },
        "product_reference": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686"
        },
        "product_reference": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le"
        },
        "product_reference": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        },
        "product_reference": "gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jim Alves-Foss"
          ]
        }
      ],
      "cve": "CVE-2026-106062",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2026-09-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2546654"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap-based buffer overflow was found in GIMP\u2019s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap-based buffer overflow was found in GIMP in the DDS image loader. A local attacker could provide a specially crafted DDS file that, when opened by the victim, causes GIMP to write past the end of a heap-allocated buffer. This could crash GIMP or potentially execute arbitrary code with the privileges of the user running GIMP. The attacker must convince the user to open the malicious file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106062"
        },
        {
          "category": "external",
          "summary": "RHBZ#2546654",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546654"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106062",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106062"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106062",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106062"
        }
      ],
      "release_date": "2026-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T17:58:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "category": "workaround",
          "details": "To mitigate this do not open DDS files from untrusted sources. Exploitation may be harder on hardened systems (Full RELRO/PIE, ASLR, FORTIFY_SOURCE, heap allocator protections) but the vulnerability remains.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Alexey Khairov (codem4ster)",
            "Nikolay Kravtsov (Kolya080808)",
            "Konstantin Talgarenko (Marcusov)"
          ]
        }
      ],
      "cve": "CVE-2026-112257",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "discovery_date": "2026-10-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555574"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw affects the PSD plug-in thumbnail path. Exploitation requires user interaction (browsing a folder with a crafted PSD in GIMP\u2019s file dialog, or opening the file). Red Hat rates this Important.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112257"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555574",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555574"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112257",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112257"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112257",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112257"
        }
      ],
      "release_date": "2026-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T17:58:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "category": "workaround",
          "details": "Avoid opening or browsing untrusted PSD files in GIMP. If GIMP is unused, remove the gimp package.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033)"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Alexey Khairov (codem4ster)",
            "Nikolay Kravtsov (Kolya080808)",
            "Konstantin Talgarenko (Marcusov)"
          ]
        }
      ],
      "cve": "CVE-2026-112258",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-10-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555588"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Important severity because successful exploitation allows arbitrary code execution in the security context of the user running the application. Although GIMP is an interactive desktop utility and does not listen on network sockets, memory corruption during project parsing enables an attacker to hijack program control. The severity is constrained by the necessity of user interaction, as an attacker must trick a target into opening a malicious XCF file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112258"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555588",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555588"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112258",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112258"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112258",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112258"
        }
      ],
      "release_date": "2026-10-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T17:58:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "category": "workaround",
          "details": "Avoid opening untrusted XCF files in GIMP until an update is available. If GIMP is unused, remove the gimp package.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Alexey Khairov (codem4ster)",
            "Nikolay Kravtsov (Kolya080808)",
            "Konstantin Talgarenko (Marcusov)"
          ]
        }
      ],
      "cve": "CVE-2026-112260",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555730"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because it allows arbitrary heap memory exposure and process crashes without requiring privileged access. In Red Hat Enterprise Linux environments, GIMP is an interactive desktop graphics editor rather than a network service, meaning the flaw cannot be triggered remotely without user intervention. An attacker must convince a user to load a specially crafted project file, which may leak confidential process data into generated layers or terminate the application unexpectedly.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112260"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555730",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555730"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112260",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112260"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112260",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112260"
        }
      ],
      "release_date": "2026-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T17:58:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "category": "workaround",
          "details": "Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Alexey Khairov (codem4ster, dedicated to Diana)",
            "Nikolay Kravtsov (Kolya080808, dedicated to Nonna)",
            "Konstantin Talgarenko (Marcusov, dedicated to Karina)"
          ]
        }
      ],
      "cve": "CVE-2026-112261",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-10-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555748"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this issue as having an impact of Important because memory corruption can lead to arbitrary code execution within the context of the user executing the application. GIMP is an interactive desktop image manipulation tool and is not deployed as a network-facing service or background daemon. Consequently, the flaw cannot be exploited without direct user interaction, specifically opening an untrusted, maliciously crafted project file. Earlier versions of Red Hat Enterprise Linux shipping older GIMP major releases are not affected, as the vulnerable code path is not present.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-112261"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555748",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555748"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-112261",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-112261"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-112261",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112261"
        }
      ],
      "release_date": "2026-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T17:58:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "category": "workaround",
          "details": "Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.src",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-debugsource-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-devel-tools-debuginfo-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-2:3.0.4-4.el9_8.15.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:gimp-libs-debuginfo-2:3.0.4-4.el9_8.15.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH"
    }
  ]
}

CVE-2026-106062 (GCVE-0-2026-106062)

Vulnerability from cvelistv5 – Published: 2026-10-06 20:02 – Updated: 2026-11-04 21:41

Title

Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 16:25 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:93975	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-106062	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2546654	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:3.0.4-4.el9_8.15 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/a:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/a:redhat:enterprise_linux:8

Date Public

2026-10-06 00:00

Credits

Red Hat would like to thank Jim Alves-Foss for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T16:25:02.536107Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T16:25:14.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:3.0.4-4.el9_8.15",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp:2.8/gimp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Jim Alves-Foss for reporting this issue."
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow was found in GIMP\u2019s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T21:41:29.455Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:93975",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-106062"
        },
        {
          "name": "RHBZ#2546654",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546654"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-22T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-06T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this do not open DDS files from untrusted sources. Exploitation may be harder on hardened systems (Full RELRO/PIE, ASLR, FORTIFY_SOURCE, heap allocator protections) but the vulnerability remains."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-106062",
    "datePublished": "2026-10-06T20:02:52.466Z",
    "dateReserved": "2026-10-06T14:26:58.730Z",
    "dateUpdated": "2026-11-04T21:41:29.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112257 (GCVE-0-2026-112257)

Vulnerability from cvelistv5 – Published: 2026-10-19 21:37 – Updated: 2026-11-05 10:02

Title

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 14:47 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:93975	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:95482	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-112257	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2555574	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020261023073604.4c9c024f , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:3.0.4-4.el9_8.15 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/a:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:rhel_els:7

Date Public

2026-10-12 00:00

Credits

Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112257",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T14:47:14.486852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T14:47:40.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp:2.8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020261023073604.4c9c024f",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:3.0.4-4.el9_8.15",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T10:02:03.812Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:93975",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "name": "RHSA-2026:95482",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:95482"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-112257"
        },
        {
          "name": "RHBZ#2555574",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555574"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-12T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)",
      "workarounds": [
        {
          "lang": "en",
          "value": "Avoid opening or browsing untrusted PSD files in GIMP. If GIMP is unused, remove the gimp package."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-112257",
    "datePublished": "2026-10-19T21:37:19.467Z",
    "dateReserved": "2026-10-19T13:14:33.431Z",
    "dateUpdated": "2026-11-05T10:02:03.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112258 (GCVE-0-2026-112258)

Vulnerability from cvelistv5 – Published: 2026-10-19 21:37 – Updated: 2026-11-04 21:54

Title

Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 20:45 UTC

CWE

CWE-416 - Use After Free

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:93975	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-112258	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2555588	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:3.0.4-4.el9_8.15 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/a:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/a:redhat:enterprise_linux:8

Date Public

2026-10-14 00:00

Credits

Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112258",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T20:45:29.211785Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T20:45:39.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:3.0.4-4.el9_8.15",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp:2.8/gimp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T21:54:53.485Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:93975",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-112258"
        },
        {
          "name": "RHBZ#2555588",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555588"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-14T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels",
      "workarounds": [
        {
          "lang": "en",
          "value": "Avoid opening untrusted XCF files in GIMP until an update is available. If GIMP is unused, remove the gimp package."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-416: Use After Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-112258",
    "datePublished": "2026-10-19T21:37:20.179Z",
    "dateReserved": "2026-10-19T13:14:38.053Z",
    "dateUpdated": "2026-11-04T21:54:53.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112260 (GCVE-0-2026-112260)

Vulnerability from cvelistv5 – Published: 2026-10-19 19:24 – Updated: 2026-11-04 21:54

Title

Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing

Summary

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 21:22 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:93975	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-112260	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2555730	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:3.0.4-4.el9_8.15 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/a:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/a:redhat:enterprise_linux:8

Date Public

2026-10-12 00:00

Credits

Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112260",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T21:22:09.818772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:22:48.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:3.0.4-4.el9_8.15",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp:2.8/gimp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T21:54:55.483Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:93975",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-112260"
        },
        {
          "name": "RHBZ#2555730",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555730"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-12T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing",
      "workarounds": [
        {
          "lang": "en",
          "value": "Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-112260",
    "datePublished": "2026-10-19T19:24:49.017Z",
    "dateReserved": "2026-10-19T13:14:46.797Z",
    "dateUpdated": "2026-11-04T21:54:55.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112261 (GCVE-0-2026-112261)

Vulnerability from cvelistv5 – Published: 2026-10-19 21:37 – Updated: 2026-11-04 21:54

Title

Gimp: gimp: use-after-free in xcf loader via prop_selected_path

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 15:16 UTC

CWE

CWE-416 - Use After Free

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:93975	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-112261	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2555748	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:3.0.4-4.el9_8.15 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/a:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/a:redhat:enterprise_linux:8

Date Public

2026-10-12 00:00

Credits

Red Hat would like to thank Alexey Khairov (codem4ster, dedicated to Diana), Konstantin Talgarenko (Marcusov, dedicated to Karina), and Nikolay Kravtsov (Kolya080808, dedicated to Nonna) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112261",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T15:16:19.306743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:08:50.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:3.0.4-4.el9_8.15",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gimp:2.8/gimp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Alexey Khairov (codem4ster, dedicated to Diana), Konstantin Talgarenko (Marcusov, dedicated to Karina), and Nikolay Kravtsov (Kolya080808, dedicated to Nonna) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T21:54:58.082Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:93975",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:93975"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-112261"
        },
        {
          "name": "RHBZ#2555748",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555748"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-12T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gimp: gimp: use-after-free in xcf loader via prop_selected_path",
      "workarounds": [
        {
          "lang": "en",
          "value": "Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-416: Use After Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-112261",
    "datePublished": "2026-10-19T21:37:25.644Z",
    "dateReserved": "2026-10-19T13:15:03.694Z",
    "dateUpdated": "2026-11-04T21:54:58.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:93975

CVE-2026-106062 (GCVE-0-2026-106062)

CVE-2026-112257 (GCVE-0-2026-112257)

CVE-2026-112258 (GCVE-0-2026-112258)

CVE-2026-112260 (GCVE-0-2026-112260)

CVE-2026-112261 (GCVE-0-2026-112261)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour