The GIMP image editing software included in Red Hat Enterprise Linux 9 contains multiple vulnerabilities: CVE-2026-42169 is a heap-buffer-overflow in the APNG loader triggered when the fcTL width exceeds the IHDR width; CVE-2026-66758 is a heap-based buffer overflow caused by an integer overflow in the file-fits plugin when processing crafted FITS images; CVE-2026-66759 is an out-of-bounds read in the file-icns plugin that can cause information disclosure or crash on crafted ICNS images. Red Hat has released a security update (gimp-3.0.4-4.el9_8.9) that fixes these issues. The advisory rates the impact as Important and provides packages for multiple architectures. No CVSS scores are provided in the advisory, but the issues involve memory corruption and information disclosure risks.

Successful exploitation of these vulnerabilities could lead to heap-based buffer overflows and out-of-bounds reads, potentially causing application crashes, information disclosure, or other undefined behavior when processing specially crafted image files. This could affect the confidentiality and availability of systems running vulnerable versions of GIMP on Red Hat Enterprise Linux 9.

Red Hat has released an official security update for GIMP (version 3.0.4-4.el9_8.9) that addresses these vulnerabilities. Users running affected versions of Red Hat Enterprise Linux 9 should apply this update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.