The Red Hat Security Advisory RHSA-2026:5434 addresses four remote code execution vulnerabilities in GIMP 2.8 related to uninitialized memory usage in PGM file parsing (CVE-2026-2044), out-of-bounds write in XWD file parsing (CVE-2026-2045), a vulnerability in ICO file parsing (CVE-2026-0797), and another XWD file parsing vulnerability (CVE-2026-2048). These vulnerabilities stem from improper handling of image file formats, potentially allowing attackers to execute arbitrary code when processing maliciously crafted image files. Red Hat has released updated gimp packages for Red Hat Enterprise Linux 8.6 variants to fix these issues. The advisory rates the update as Important, indicating a high security impact. Detailed CVSS scores are available on the respective CVE pages. The vendor advisory includes instructions and links for applying the update.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems by tricking users or applications into processing maliciously crafted image files. This could lead to full system compromise depending on the privileges of the user running GIMP. The vulnerabilities affect the image parsing components of GIMP, making it a critical risk for users who open untrusted image files. No known active exploits have been reported, but the severity is high due to the potential for remote code execution.

Red Hat has released updated gimp:2.8 packages for Red Hat Enterprise Linux 8.6 that address these vulnerabilities. Users should apply the security update RHSA-2026:5434 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory beyond applying the official patch. Patch status is confirmed as available and the update should be deployed to affected systems.