Gimp Security Update — AlmaLinux 9 (ALSA-2026:93975)

Type:

security

Severity:

important

Release date:

2026-11-04

Description:

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

* gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
* gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
* gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
* gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

• CVE-2026-106062
• CVE-2026-112257
• CVE-2026-112258
• CVE-2026-112260
• CVE-2026-112261
• RHSA-2026:93975
• ALSA-2026:93975

Updated packages listed below:

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.