gimp-3.2.6-1.1 on GA media

The GIMP (GNU Image Manipulation Program) version 2.8 on Red Hat Enterprise Linux 8 contains multiple security flaws: a stack buffer overflow in pnmscanner_gettoken() (CVE-2026-58380), an integer overflow in the file-fits plugin causing a heap-based buffer overflow (CVE-2026-66758), and several remote code execution vulnerabilities via crafted image file parsing including PSD (CVE-2026-18301), TIF (CVE-2026-18303, CVE-2026-18304, CVE-2026-18305, CVE-2026-18307), and SGI file formats (CVE-2026-18306). These vulnerabilities allow an attacker to execute arbitrary code by supplying specially crafted image files. Red Hat has issued an important security advisory with updates to mitigate these issues.

Successful exploitation of these vulnerabilities could lead to arbitrary code execution on affected systems when processing maliciously crafted image files. This poses a significant security risk as it may allow attackers to gain control over the system running GIMP. The vulnerabilities affect multiple image file parsers, increasing the attack surface.

Red Hat has released security updates for GIMP 2.8 on Red Hat Enterprise Linux 8 to address these vulnerabilities. Users should apply the provided security update (gimp-2.8.22-26.module+el8.10.0) as soon as possible. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.