The GIMP image editing program in Red Hat Enterprise Linux 8.4 contains multiple remote code execution vulnerabilities related to parsing of PGM, XWD, and ICO image files. Specifically, these include uninitialized memory usage in PGM file parsing (CVE-2026-2044), out-of-bounds write in XWD file parsing (CVE-2026-2045), a vulnerability in ICO file parsing (CVE-2026-0797), and another XWD file parsing vulnerability (CVE-2026-2048). Red Hat Product Security has released an important security advisory (RHSA-2026:5436) with updated packages to fix these issues. The advisory covers Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support versions. No CVSS scores are provided in the advisory, but the severity is rated as important.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely by tricking a user into opening a specially crafted image file in GIMP. This could lead to full compromise of the affected system. The vulnerabilities affect the image parsing components of GIMP and are considered high severity by Red Hat. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated GIMP packages for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support to address these vulnerabilities. Users should apply these official security updates as soon as possible. For detailed instructions and package information, refer to the Red Hat advisory RHSA-2026:5436 at https://access.redhat.com/errata/RHSA-2026:5436. No alternative mitigations or workarounds are specified in the advisory.