The Red Hat security advisory RHSA-2026:5435 addresses four remote code execution vulnerabilities in GIMP 2.8, specifically involving uninitialized memory usage in PGM file parsing (CVE-2026-2044), out-of-bounds write in XWD file parsing (CVE-2026-2045), a vulnerability in ICO file parsing (CVE-2026-0797), and another XWD file parsing vulnerability (CVE-2026-2048). These vulnerabilities are rated with a security impact of Important by Red Hat. The advisory provides updated packages for Red Hat Enterprise Linux 8.2 AUS to remediate these issues. No CVSS scores are provided in the advisory, but the severity is assessed as high in the input data. The vendor advisory directs users to apply the update to mitigate these remote code execution risks.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems by crafting malicious image files (PGM, XWD, ICO) that are processed by GIMP. This could lead to full system compromise depending on the privileges of the GIMP process. The advisory rates the security impact as Important, indicating significant risk if unpatched.

Red Hat has released an updated gimp:2.8 module package for Red Hat Enterprise Linux 8.2 AUS that addresses these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:5435 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation actions are indicated by the vendor advisory.