Back to Security Advisories

Gimp:2.8 Security Update — AlmaLinux 8 (ALSA-2026:95482)

ALSA-2026:95482 updates GIMP 2.8 and its module dependencies on AlmaLinux 8, fixing CVE-2026-112257 (stack buffer overflow, CVSS 7.8, CWE-121) alongside CVE-2026-4154. Update with dnf update gimp on systems where GIMP is installed — document and image conversion workers that drive GIMP on untrusted files are the exposure path.

High 7.8 CVSS
AlmaLinux 8

Affected Versions

2.8

What this means under a SharedLicense license

GIMP parses attacker-controlled images — a stack buffer overflow in that parsing converts an uploaded image file into crashes or code execution inside the processing user's context.

Type:

security

Severity:

important

Release date:

2026-11-04

Description:

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

Security Fix(es):

* tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data (CVE-2026-88048)
* tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file (CVE-2026-88047)
* tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service (CVE-2026-88049)
* tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model (CVE-2026-88051)
* tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file (CVE-2026-88053)
* tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution (CVE-2026-88052)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
ppc64le tesseract-devel-4.1.1-11.el9_8.ppc64le.rpm d07b25144085a5ebdbd885372536dc6bf7314dd779430c957a2ff9a9d08f6aa6

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is ALSA-2026:95482?
It is AlmaLinux's GIMP 2.8 erratum for AlmaLinux 8, fixing CVE-2026-112257 — a stack buffer overflow (CWE-121, CVSS 7.8) — along with CVE-2026-4154, in the image editor and its module dependencies.
Who is affected?
AlmaLinux 8 systems with GIMP installed — workstations that open images and automated pipelines driving GIMP on untrusted files (thumbnailing, format conversion).
How do I apply the fix?
Run dnf update gimp (including the pygtk2/python2-cairo module packages the erratum covers) and restart any GIMP-driven processing workers.
Is GIMP 2.8 itself outdated?
Yes — 2.8 is a legacy branch; AlmaLinux ships it in a module for compatibility. This erratum backports the security fixes to that branch, which is the fix path for systems pinned to it.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System