Red Hat Product Errata RHSA-2026:4173 - Security Advisory
Issued:
2026-03-10
Updated:
2026-03-10

RHSA-2026:4173 - Security Advisory

Synopsis

Important: gimp security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for gimp is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing (CVE-2026-2047)
  • gimp: GIMP: Remote Code Execution via uninitialized memory in PGM file parsing (CVE-2026-2044)
  • gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing (CVE-2026-2045)
  • gimp: GIMP: Remote Code Execution via ICO File Parsing Vulnerability (CVE-2026-0797)
  • gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability (CVE-2026-2048)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2441517 - CVE-2026-2047 gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing
  • BZ - 2441521 - CVE-2026-2044 gimp: GIMP: Remote Code Execution via uninitialized memory in PGM file parsing
  • BZ - 2441522 - CVE-2026-2045 gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing
  • BZ - 2441524 - CVE-2026-0797 gimp: GIMP: Remote Code Execution via ICO File Parsing Vulnerability
  • BZ - 2441527 - CVE-2026-2048 gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability

Red Hat Enterprise Linux for x86_64 9

SRPM
gimp-3.0.4-1.el9_7.4.src.rpm SHA-256: 3691f6a0bcda7ec067f14dfb5a86a8631069c86f633ee3d525f09ae578efca7f
x86_64
gimp-3.0.4-1.el9_7.4.x86_64.rpm SHA-256: 3fcf9c9032ea080aa91d2a54a9bd638ff0d3e3b646f932408bca72f936d8a382
gimp-debuginfo-3.0.4-1.el9_7.4.i686.rpm SHA-256: bbd4fd6e0d4d891528844fa46fad486110225df6e8be30e478d3903b31d8b9d7
gimp-debuginfo-3.0.4-1.el9_7.4.x86_64.rpm SHA-256: b72a3287e0e11be87fd4880f1f40a7fc0b4c196e67437719f26b330ed2f85f76
gimp-debugsource-3.0.4-1.el9_7.4.i686.rpm SHA-256: ead6a9ef7280121b396c330019d8550bf4380f4150c1366ca3548f02372eb1dc
gimp-debugsource-3.0.4-1.el9_7.4.x86_64.rpm SHA-256: a8cea10fb0b6787df564c1f775333457144df88e38b86b23821043e3fcebd452
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.4.i686.rpm SHA-256: 78bfc6fdb936c0f4281de7b67b802bbc3979543402b4e9099c8dd4d36ae629dc
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.4.x86_64.rpm SHA-256: cdb587f7c7b83f10ae4054888592849da6029c308cec2ee4e6b72d0468f5f13b
gimp-libs-3.0.4-1.el9_7.4.i686.rpm SHA-256: dfa32fc4f46fa3842ebefc95524d864d33913566250321419580253979ea2857
gimp-libs-3.0.4-1.el9_7.4.x86_64.rpm SHA-256: de308debf5ede87ea23418a48f7bc18a7ce49ca7853021ba562bb9f968c9caf7
gimp-libs-debuginfo-3.0.4-1.el9_7.4.i686.rpm SHA-256: 565e742777550177fc08bdff5cae763be87e0c2401a0ea6829b72d0764b34b9f
gimp-libs-debuginfo-3.0.4-1.el9_7.4.x86_64.rpm SHA-256: 2ceda1341c6aa5474dacfd522093b5623b89db642ecdee0760f9ef43a7e9ccab

Red Hat Enterprise Linux for Power, little endian 9

SRPM
gimp-3.0.4-1.el9_7.4.src.rpm SHA-256: 3691f6a0bcda7ec067f14dfb5a86a8631069c86f633ee3d525f09ae578efca7f
ppc64le
gimp-3.0.4-1.el9_7.4.ppc64le.rpm SHA-256: 71d0d6eea74cc68ff69dc9d0e8be79ed84b329f2ab3564a865568377d41b84e4
gimp-debuginfo-3.0.4-1.el9_7.4.ppc64le.rpm SHA-256: d9c3d0fe68e3bdae477443be64e5d378f5829c35ed51c9688261a8751eaf4f65
gimp-debugsource-3.0.4-1.el9_7.4.ppc64le.rpm SHA-256: 88e87bc6f6d807115917f2f65405a69f2b5faffd13827e744469c6b3ac2d6ec1
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.4.ppc64le.rpm SHA-256: 5e500bb52a173228fcd631791f90256ee2eced37d878a3b0cb50c5f5ba765b0b
gimp-libs-3.0.4-1.el9_7.4.ppc64le.rpm SHA-256: 2817ebf5cda2d1f6e5a974ca049f3004b22232c3f6018643706e31cd9d61fe0f
gimp-libs-debuginfo-3.0.4-1.el9_7.4.ppc64le.rpm SHA-256: d5cc0c79a75b86758feaa992ac93f8a8dd410748fe6799eff3e8c2e640f6ac08

Red Hat Enterprise Linux for ARM 64 9

SRPM
gimp-3.0.4-1.el9_7.4.src.rpm SHA-256: 3691f6a0bcda7ec067f14dfb5a86a8631069c86f633ee3d525f09ae578efca7f
aarch64
gimp-3.0.4-1.el9_7.4.aarch64.rpm SHA-256: 813e7e73ee117e0c698e80e425d3c035b1e0dd80d2421f82b23ee377b208a1cd
gimp-debuginfo-3.0.4-1.el9_7.4.aarch64.rpm SHA-256: 70a19e01b5b29aed61f70303dc0cb926f303aef8db2ca128cffbcd3cd48ebe10
gimp-debugsource-3.0.4-1.el9_7.4.aarch64.rpm SHA-256: 9ba2fd66ecae34acc2e074f8b26db510165afb8c9fa0d435f6b98fead3416d44
gimp-devel-tools-debuginfo-3.0.4-1.el9_7.4.aarch64.rpm SHA-256: 51d132eccb02368734ff2874b3bec62ebf64e1d1b13a6a1bbc6387ae153d10a4
gimp-libs-3.0.4-1.el9_7.4.aarch64.rpm SHA-256: ad2ea969c1b3231bbda94d4f761e6d7b76fee69283f09bcd57a4f8aedee6a81a
gimp-libs-debuginfo-3.0.4-1.el9_7.4.aarch64.rpm SHA-256: 8ccf0973be44ab439d599fa706f2d2d3eea9f5d80f11c6d0fcce1bfa648688b8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.