Gimp Security Update — AlmaLinux 9 (ALSA-2026:93975)

ALSA-2026:93975 updates GIMP on AlmaLinux 9, fixing five CVEs (CVE-2026-106062, CVE-2026-112257, CVE-2026-112258, CVE-2026-112260, CVE-2026-112261) in the image editor's parsing and plugin handling. Update with dnf update gimp on systems where GIMP is installed — typically workstations and document-processing images.

High 7.8 CVSS 2026-11-04

AlmaLinux 9

What this means under a SharedLicense license

GIMP parses attacker-controlled images — memory-corruption flaws in file and plugin parsing convert a crafted image file into crashes or code execution in the user's session.

Type:

security

Severity:

important

Release date:

2026-11-04

Description:

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

* gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
* gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
* gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
* gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	gimp-3.0.4-4.el9_8.15.aarch64.rpm	aeba5945ef74480f7c5e26c13f097649305fd1fdfe58d90f03a44b30d6941a8d
aarch64	gimp-libs-3.0.4-4.el9_8.15.aarch64.rpm	ee9ad02fc1dd72862eada4fb9b0cf1952ec70593c75c1f82beebe939557afdfc
i686	gimp-libs-3.0.4-4.el9_8.15.i686.rpm	4414d5273d27c206a8ee1e335411f788069254598fb09a0b97b00e7634d38953
ppc64le	gimp-3.0.4-4.el9_8.15.ppc64le.rpm	874ca16e40225faaef3597b6aa8ac951f0d426a54d41401e24bf7207df4c605c
ppc64le	gimp-libs-3.0.4-4.el9_8.15.ppc64le.rpm	e1be647ac8d81832f594aac6d7ca89cf3e7613b3914a874e65d57162ec2284f1
x86_64	gimp-libs-3.0.4-4.el9_8.15.x86_64.rpm	40022c0692c6cf56ffdb862f4b456ff8314f3712da0765e13d1dab78dc88e43a
x86_64	gimp-3.0.4-4.el9_8.15.x86_64.rpm	47f5a12b6181b78a3a88c9d39900c1e634a1b252e692421872d93261a162516e

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is ALSA-2026:93975?

It is AlmaLinux's GIMP erratum for AlmaLinux 9, fixing five CVEs (CVE-2026-106062, CVE-2026-112257, CVE-2026-112258, CVE-2026-112260, CVE-2026-112261) in the image editor's file parsing and plugin handling.

Who is affected?

AlmaLinux 9 systems with GIMP installed — workstations that open images and automated processing environments that drive GIMP on untrusted files.

How do I apply the fix?

Run dnf update gimp and restart GIMP if running; batch-processing setups should restart their workers so the patched libraries load.

Why would a hosting server have GIMP?

Usually for automated image thumbnails or conversions driven by scripts — in that role it parses user-uploaded images, which makes these parsing fixes operationally relevant even on a server.

References

Security Advisories

Related Advisories

Kernel Security Update — AlmaLinux 9 (ALSA-2026:93412)

2026-11-09

Fence-Agents Security Update — AlmaLinux 9 (ALSA-2026:94500)

2026-11-04

Cockpit Security Update — AlmaLinux 9 (ALSA-2026:94533)

2026-11-04

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System