The GIMP image editing program contains two vulnerabilities: a stack buffer overflow (CVE-2026-58380) in the pnmscanner_gettoken() function and an integer overflow (CVE-2026-58384) in the read_RLE_channel() function. These vulnerabilities could potentially lead to security issues if exploited. Red Hat has released security updates for Red Hat Enterprise Linux 9 to fix these flaws, as detailed in advisory RHSA-2026:40751. The advisory includes updated package versions (e.g., gimp-3.0.4-4.el9_8.7) for multiple architectures and variants of Red Hat Enterprise Linux 9. No CVSS scores are provided in the advisory, but the impact is rated as important.

The identified vulnerabilities involve memory corruption issues (stack buffer overflow and integer overflow) in GIMP, which could be exploited to cause crashes or potentially execute arbitrary code. Red Hat rates the security impact as important, indicating a significant risk if unpatched. No known exploits in the wild have been reported at this time.

Red Hat has released updated GIMP packages for Red Hat Enterprise Linux 9 and its variants to address these vulnerabilities. Users should apply these official security updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires manual update by system administrators. No alternative mitigations or workarounds are stated in the advisory.