Red Hat Product Errata RHSA-2026:98495 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98495 - Security Advisory

Synopsis

Important: gimp security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for gimp is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
  • gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
  • gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
  • gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
  • gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2546654 - CVE-2026-106062 gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file
  • BZ - 2555574 - CVE-2026-112257 gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033)
  • BZ - 2555588 - CVE-2026-112258 gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels
  • BZ - 2555730 - CVE-2026-112260 gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing
  • BZ - 2555748 - CVE-2026-112261 gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH

Red Hat Enterprise Linux for x86_64 9

SRPM
gimp-3.0.4-8.el9_9.5.src.rpm SHA-256: 03674b61d1015af082ef25af33a6c320ced79a2697ff0c2b20b7cd4ded45d0d4
x86_64
gimp-3.0.4-8.el9_9.5.x86_64.rpm SHA-256: ca7b17fddbc75b6dc5945d763e6ae522901f4e7f985052bbdd632989e89b8b7f
gimp-debuginfo-3.0.4-8.el9_9.5.i686.rpm SHA-256: 29833c292369173559fd202844d7d556fcdff54ed82c808c6677b752b22c92cd
gimp-debuginfo-3.0.4-8.el9_9.5.x86_64.rpm SHA-256: c87b89a986e2f34b502c7c2e83a70b5ba55cb69add210c55dfc7ba0694a88759
gimp-debugsource-3.0.4-8.el9_9.5.i686.rpm SHA-256: 495abc08a906f1592b3931f3cb5a7fb67c70eef5056a93c91bab9bd3e7f6c9ab
gimp-debugsource-3.0.4-8.el9_9.5.x86_64.rpm SHA-256: 263a42e4da2fe811c0343a32681af8b842d2935e0f666c651fb372f12c90c3da
gimp-devel-tools-debuginfo-3.0.4-8.el9_9.5.i686.rpm SHA-256: 7679acd0a7300f295e2ff67ea5dcfcf9d3a8a721483049b82180d4356b4ddc14
gimp-devel-tools-debuginfo-3.0.4-8.el9_9.5.x86_64.rpm SHA-256: 427674adf3f861d6435549ed653ac9b49ac10ea3d9a245eab08b9e20677ac011
gimp-libs-3.0.4-8.el9_9.5.i686.rpm SHA-256: ae7cadfed7ccd5061e91ab38e6d8297487a4d98010215a5d09625227aff700ad
gimp-libs-3.0.4-8.el9_9.5.x86_64.rpm SHA-256: bd5e4b68108119f9475b53e15a8b7eeaa519688b31c0c471a56a9b38871866e3
gimp-libs-debuginfo-3.0.4-8.el9_9.5.i686.rpm SHA-256: 52cc3be7cf395eb276b75e0294021e7c43328e6a349322552ed30c8adc47d843
gimp-libs-debuginfo-3.0.4-8.el9_9.5.x86_64.rpm SHA-256: 836280705915b329c8787e8db8fd07c42eaf77facf4b7f7965ac80163cbaabae

Red Hat Enterprise Linux for Power, little endian 9

SRPM
gimp-3.0.4-8.el9_9.5.src.rpm SHA-256: 03674b61d1015af082ef25af33a6c320ced79a2697ff0c2b20b7cd4ded45d0d4
ppc64le
gimp-3.0.4-8.el9_9.5.ppc64le.rpm SHA-256: 1ce342001901a92063fc1cb92f46541d45809d627c3876c022509042d7fa365f
gimp-debuginfo-3.0.4-8.el9_9.5.ppc64le.rpm SHA-256: ec5931da17986c37ed03c51f212b6525f691af36a25689d4919f3537786a1c60
gimp-debugsource-3.0.4-8.el9_9.5.ppc64le.rpm SHA-256: 17d0bdbe61a73c5ebd59128d2303de02c6385245a6172ab2c6cf4338b4299ff5
gimp-devel-tools-debuginfo-3.0.4-8.el9_9.5.ppc64le.rpm SHA-256: 39df5527ce1bccf10f1f8ecf1e0212f2350e4d070eb3a453c51ce5a79a0b6b3b
gimp-libs-3.0.4-8.el9_9.5.ppc64le.rpm SHA-256: a87032849c7b8d550e000b26a7542783cc5452c42e3e12477b36f16390c29d6d
gimp-libs-debuginfo-3.0.4-8.el9_9.5.ppc64le.rpm SHA-256: 9bdfe6bd37f20b8d5056e8a702412478c4b504253c8f21734e32567a2120a5e9

Red Hat Enterprise Linux for ARM 64 9

SRPM
gimp-3.0.4-8.el9_9.5.src.rpm SHA-256: 03674b61d1015af082ef25af33a6c320ced79a2697ff0c2b20b7cd4ded45d0d4
aarch64
gimp-3.0.4-8.el9_9.5.aarch64.rpm SHA-256: a72379d19e0c1cef55cad36eefa409669c6bd955bfa71bf4df7282b14c43aee3
gimp-debuginfo-3.0.4-8.el9_9.5.aarch64.rpm SHA-256: 35515c52418bf9bc9496f8746cae6f28e9ce4290ec1e4b96e98aad0181f52901
gimp-debugsource-3.0.4-8.el9_9.5.aarch64.rpm SHA-256: ca642d59f659e59c845ed8246e9aa5d6b7e315278d6246721c8fe7daee6fe244
gimp-devel-tools-debuginfo-3.0.4-8.el9_9.5.aarch64.rpm SHA-256: e34829ed574753c9e47f9e9ce594a165570a5a2922642cced8bf4ef5bd9c4ed7
gimp-libs-3.0.4-8.el9_9.5.aarch64.rpm SHA-256: e33e923cbba128e04a445ff69ff47c513d17b9f33b859e80f50e5ad436943d95
gimp-libs-debuginfo-3.0.4-8.el9_9.5.aarch64.rpm SHA-256: f5907479ba084013dc805db0ed24c101869aeb1e3de48444ceb66c0f0f51c7df

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.