Red Hat Product Errata RHSA-2026:5390 - Security Advisory
Issued:
2026-03-23
Updated:
2026-03-23

RHSA-2026:5390 - Security Advisory

Synopsis

Important: gimp security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for gimp is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP: Remote Code Execution via uninitialized memory in PGM file parsing (CVE-2026-2044)
  • gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing (CVE-2026-2045)
  • gimp: GIMP: Remote Code Execution via ICO File Parsing Vulnerability (CVE-2026-0797)
  • gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability (CVE-2026-2048)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x

Fixes

  • BZ - 2441521 - CVE-2026-2044 gimp: GIMP: Remote Code Execution via uninitialized memory in PGM file parsing
  • BZ - 2441522 - CVE-2026-2045 gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing
  • BZ - 2441524 - CVE-2026-0797 gimp: GIMP: Remote Code Execution via ICO File Parsing Vulnerability
  • BZ - 2441527 - CVE-2026-2048 gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0

SRPM
gimp-2.99.8-3.el9_0.5.src.rpm SHA-256: 8e89b928de5395a2e06f8b104fd4862196cf1f0107ff2d2cb45e28ed6387de28
ppc64le
gimp-2.99.8-3.el9_0.5.ppc64le.rpm SHA-256: 1af3107c9acd267c27186ec5647eaf6c0c67471846e5c537c4ab035cd59ca734
gimp-debuginfo-2.99.8-3.el9_0.5.ppc64le.rpm SHA-256: 59b47d64e13d35acd8e1a9519d595e818e8533afbf77a33b1209abfa0beec034
gimp-debugsource-2.99.8-3.el9_0.5.ppc64le.rpm SHA-256: 92c35209d386aaf0584d14d18a83157ace0482535b0b5bc5ef13baefe2acf54a
gimp-devel-tools-debuginfo-2.99.8-3.el9_0.5.ppc64le.rpm SHA-256: 8f3f4896be9702eb78738877580853f2274b77187f9835f93c5fb07c9b9753b3
gimp-libs-2.99.8-3.el9_0.5.ppc64le.rpm SHA-256: 4304772486fd574cf8926b7ab2758efd681f286c4299e6fedd3a55db4ee1cd42
gimp-libs-debuginfo-2.99.8-3.el9_0.5.ppc64le.rpm SHA-256: 0255e72a62db77a6cd637e43851b8509024541f609ca25e109dc32915218e817

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0

SRPM
gimp-2.99.8-3.el9_0.5.src.rpm SHA-256: 8e89b928de5395a2e06f8b104fd4862196cf1f0107ff2d2cb45e28ed6387de28
x86_64
gimp-2.99.8-3.el9_0.5.x86_64.rpm SHA-256: 345e27dbd4349ec1314c8ad7c081b23b15f02056d94e46add378848582732653
gimp-debuginfo-2.99.8-3.el9_0.5.i686.rpm SHA-256: d1ccd4a9f7ba1bbc21746b067eb9621ba1cc96033d64518433fc8e5ca5f42205
gimp-debuginfo-2.99.8-3.el9_0.5.x86_64.rpm SHA-256: 267403b27932e9e226b0d3abc8a0768a03b240258229815cf4d8537da026b574
gimp-debugsource-2.99.8-3.el9_0.5.i686.rpm SHA-256: 740b637b28ce9032b5ab0277c23b35d5f1e40f0e26c3ff59c38c2016f48ebc21
gimp-debugsource-2.99.8-3.el9_0.5.x86_64.rpm SHA-256: c3c97a4bceeaa273e8e37aefa98b05a3e5cfef59db829daf672050e1b02cfc53
gimp-devel-tools-debuginfo-2.99.8-3.el9_0.5.i686.rpm SHA-256: eab5e7e923d0a3de1f5b65d472c224cf32cf27fd8fd60ebd74565efc8f459a2f
gimp-devel-tools-debuginfo-2.99.8-3.el9_0.5.x86_64.rpm SHA-256: 4bfe5a28341fca9716462ec35957d52a2a077128f8500a681dce4afc87b37bf4
gimp-libs-2.99.8-3.el9_0.5.i686.rpm SHA-256: 209159056295d17cacdb1a75c39165fb4fff34e354c803adccc2405b6f400a4c
gimp-libs-2.99.8-3.el9_0.5.x86_64.rpm SHA-256: 74b354a0a7939d6ede94f1e2e678cb3b6dfbb4c19f8baa2517a92682be94b9e5
gimp-libs-debuginfo-2.99.8-3.el9_0.5.i686.rpm SHA-256: b5032b047afccb742923c1519dd6fa69c895396ebf588ac3c771c353cd75f002
gimp-libs-debuginfo-2.99.8-3.el9_0.5.x86_64.rpm SHA-256: 36204cecf9e939b99e651f46c8692a287857d18ba538fc4e1b16b01302b13fdf

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0

SRPM
gimp-2.99.8-3.el9_0.5.src.rpm SHA-256: 8e89b928de5395a2e06f8b104fd4862196cf1f0107ff2d2cb45e28ed6387de28
aarch64
gimp-2.99.8-3.el9_0.5.aarch64.rpm SHA-256: b89b398a6fb51bb55beff0628287221f4077448500f5c066c9fbb9027367d9e4
gimp-debuginfo-2.99.8-3.el9_0.5.aarch64.rpm SHA-256: 1568cdc7e475b22a97d0fbfbec59fc460c8e8f5fb184c428ee7dbc65b924fe64
gimp-debugsource-2.99.8-3.el9_0.5.aarch64.rpm SHA-256: 23a9fe4c9aa7dc1efe618aef40dcc2b40c95d962238e95b31a474af8afc7457a
gimp-devel-tools-debuginfo-2.99.8-3.el9_0.5.aarch64.rpm SHA-256: a90d7365398360eac96ffbed2689c59ab22170d019f2965be809e8f9d29c89a8
gimp-libs-2.99.8-3.el9_0.5.aarch64.rpm SHA-256: 1ca417160062c8e4f600fc203f00b5ec6f3fb6d76a72d3b0b831e8718d4770d4
gimp-libs-debuginfo-2.99.8-3.el9_0.5.aarch64.rpm SHA-256: 11c3a2216ae8bbdef9e75b6c3b04717b6e5a56750b17f11ce128a88cf4bb1861

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0

SRPM
gimp-2.99.8-3.el9_0.5.src.rpm SHA-256: 8e89b928de5395a2e06f8b104fd4862196cf1f0107ff2d2cb45e28ed6387de28
s390x
gimp-2.99.8-3.el9_0.5.s390x.rpm SHA-256: 8c94dc20356d1582b095b241fdb4cd2db48cd14a708c46213629a1ed4e00075a
gimp-debuginfo-2.99.8-3.el9_0.5.s390x.rpm SHA-256: ed4e213469802f4ef80fde765b1db86d596d544d7ba2138304a5f1bb8048b4fc
gimp-debugsource-2.99.8-3.el9_0.5.s390x.rpm SHA-256: e9fb071b2a69ce32d4b1a9d21b0d5547a37d4d175da43d8c7469a5b8ca461c30
gimp-devel-tools-debuginfo-2.99.8-3.el9_0.5.s390x.rpm SHA-256: 96c9e42d3e693305947bcaa88e640c38f637a57b9d77156a0c5dde2e065a6845
gimp-libs-2.99.8-3.el9_0.5.s390x.rpm SHA-256: df251931c35f12f027778bb1a9bec9388d5e8aef9e406af84d0ebf2b4a07e534
gimp-libs-debuginfo-2.99.8-3.el9_0.5.s390x.rpm SHA-256: ce0621ee729da366195cf268229010e4d411dd1b8d7864022660fa3b9657bb17

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.