Red Hat Product Errata RHSA-2026:0914 - Security Advisory
Issued:
2026-01-21
Updated:
2026-01-21

RHSA-2026:0914 - Security Advisory

Synopsis

Important: gimp security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for gimp is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP: Remote Code Execution via PNM file parsing integer overflow (CVE-2025-14422)
  • gimp: GIMP: Remote Code Execution via JP2 file parsing heap-based buffer overflow (CVE-2025-14425)
  • gimp: GIMP: Remote Code Execution via XCF File Parsing Use-After-Free (CVE-2025-14424)
  • gimp: GIMP: Remote Code Execution via stack-based buffer overflow in LBM file parsing (CVE-2025-14423)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2424766 - CVE-2025-14422 gimp: GIMP: Remote Code Execution via PNM file parsing integer overflow
  • BZ - 2424767 - CVE-2025-14425 gimp: GIMP: Remote Code Execution via JP2 file parsing heap-based buffer overflow
  • BZ - 2424774 - CVE-2025-14424 gimp: GIMP: Remote Code Execution via XCF File Parsing Use-After-Free
  • BZ - 2424782 - CVE-2025-14423 gimp: GIMP: Remote Code Execution via stack-based buffer overflow in LBM file parsing

Red Hat Enterprise Linux for x86_64 9

SRPM
gimp-3.0.4-1.el9_7.2.src.rpm SHA-256: b0abd943d38fcc6ac4a392ce30b39f96809cb676b694babecfc277d55a00d2f2
x86_64
gimp-3.0.4-1.el9_7.2.x86_64.rpm SHA-256: d8c3cf823513ad79599de576225a04f83e567ca3261b7e24a847aca14f2a8a89
gimp-debuginfo-3.0.4-1.el9_7.2.i686.rpm SHA-256: 44fa3cf723c357562492fc47df0f9f10dd48783178731a846ba88cc0d19f548e
gimp-debuginfo-3.0.4-1.el9_7.2.x86_64.rpm SHA-256: 40e3a53da20825b9b8499cda2040deab7942809c6d5666f39f99b4f0174e000b
gimp-debugsource-3.0.4-1.el9_7.2.i686.rpm SHA-256: 2aba7dbcc3c93ccd96e49f495677fc87c575c92235f571b7b6a728e91b8f8ad9
gimp-debugsource-3.0.4-1.el9_7.2.x86_64.rpm SHA-256: c33758e0fb19e069dc2e17fb17244616e67ba17252025a96194e25d5151a5e1b
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.2.i686.rpm SHA-256: 4f0f57e1fd619a71877597a22d276c62684733de63585a88785f9fb3c58cff3a
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.2.x86_64.rpm SHA-256: bf2d40517c08264dc4f4a94bf5382228f84f8b1b31feb6aac4390181e6ba0064
gimp-libs-3.0.4-1.el9_7.2.i686.rpm SHA-256: c8a02be1c5c8615be7adeffb7e7db3825f8d8f6c113634024a24f4628a031dd9
gimp-libs-3.0.4-1.el9_7.2.x86_64.rpm SHA-256: 457ffdc896aa14534723b78ded5119629adc55eda18f9a81a9ad48fff5da171d
gimp-libs-debuginfo-3.0.4-1.el9_7.2.i686.rpm SHA-256: 1d72ef533ff694ac446946c30789a9614e7ec068574cce6da61a43626009e45f
gimp-libs-debuginfo-3.0.4-1.el9_7.2.x86_64.rpm SHA-256: 9de7d36255a1bf68b5adf52fa4023f2756fa42e00e3bac693357537d4cf95112

Red Hat Enterprise Linux for Power, little endian 9

SRPM
gimp-3.0.4-1.el9_7.2.src.rpm SHA-256: b0abd943d38fcc6ac4a392ce30b39f96809cb676b694babecfc277d55a00d2f2
ppc64le
gimp-3.0.4-1.el9_7.2.ppc64le.rpm SHA-256: 608af42d057ce556f1582dad8ed59ad825819ec527db34634365e65e754ad544
gimp-debuginfo-3.0.4-1.el9_7.2.ppc64le.rpm SHA-256: d3ab08e082671126b6b59c3706fb2bd543bcbd9e1380648cc56a8159749d5a2a
gimp-debugsource-3.0.4-1.el9_7.2.ppc64le.rpm SHA-256: fbb0043d9ed15c5ffc0b798aac8576eae5c4cf17d1ae46d4b1f43c5f8a6eb642
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.2.ppc64le.rpm SHA-256: b4e302f24aefd1f185f1db3ed74b8fcabbb377b7a30a1b626409c7e24c76afa1
gimp-libs-3.0.4-1.el9_7.2.ppc64le.rpm SHA-256: ff15f37596e87dc82c3bea4387dafb7d49660e88b410c9ecd0669b551e4c55bc
gimp-libs-debuginfo-3.0.4-1.el9_7.2.ppc64le.rpm SHA-256: a16fffbb19dfee4b21759e971405cf1db122a0acf923bec63462531b9c7511e3

Red Hat Enterprise Linux for ARM 64 9

SRPM
gimp-3.0.4-1.el9_7.2.src.rpm SHA-256: b0abd943d38fcc6ac4a392ce30b39f96809cb676b694babecfc277d55a00d2f2
aarch64
gimp-3.0.4-1.el9_7.2.aarch64.rpm SHA-256: d7ca13fa6b8a5514253a5b1dcc8c9241e5d5dbddb3fb1c5468a69e9b72dff251
gimp-debuginfo-3.0.4-1.el9_7.2.aarch64.rpm SHA-256: 9a503c8e7024397c052fce67489dba14344377322080d51aa6bc4d4e40061a86
gimp-debugsource-3.0.4-1.el9_7.2.aarch64.rpm SHA-256: 337752ecf182883c0936c71c4e371aaae5aaf5cbb913159ecc9a0d2e6e274ff7
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.2.aarch64.rpm SHA-256: d38ab386888425f57636ccd889bfdc5195c9c5742ff4ff0df6ce2b5936126d23
gimp-libs-3.0.4-1.el9_7.2.aarch64.rpm SHA-256: b2aaf4bfe68b5fcbe2cecb2d2aba20b0132c3247d35c005b01938c82a5a62fdc
gimp-libs-debuginfo-3.0.4-1.el9_7.2.aarch64.rpm SHA-256: a3674c1d3432a2f50f2252c7353309df4229905cf9e6f427d0699a44033c26cf

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.