Every CVE Search/ Get API key

CVE-2026-90947

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

7.8 HighFix available

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.13%Unchanged since Sep 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.8

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Record
CVE-2026-90947
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-77593 7.8

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Record
EUVD-2026-77593
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-pcjr-j975-j4c4 7.8

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting...

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Record
GHSA-pcjr-j975-j4c4
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.8

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Record
CVE-2026-90947
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-05
OSVDEBIAN-CVE-2026-90947 7.8

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Record
DEBIAN-CVE-2026-90947
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVOESA-2026-4223 7.8

gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.(CVE-2026-82328)

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.(CVE-2026-82330)

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.(CVE-2026-90947)

Record
OESA-2026-4223
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVRHSA-2026:75575 7.8

Red Hat Security Advisory: gimp security update

Record
RHSA-2026:75575
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:84744 7.8

Red Hat Security Advisory: gimp:2.8 security update

Record
RHSA-2026:84744
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:84744 7.8

Important: gimp:2.8 security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)

  • gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)

  • gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)

  • gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:84744
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-90947 7.8

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

Record
UBUNTU-CVE-2026-90947
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:75575 No score

Important: gimp security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
  • gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
  • gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
  • gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:75575
Updated
2026-11-02
OSVALSA-2026:84744 No score

Important: gimp:2.8 security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
  • gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
  • gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
  • gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:84744
Updated
2026-11-02
OSVCLSA-2026-1791479721 No score

gimp: Fix of 10 CVEs

  • CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
  • CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
  • CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
  • CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()
Record
CLSA-2026-1791479721
Updated
2026-11-02
OSVCLSA-2026-1791539516 No score

gimp: Fix of 4 CVEs

  • CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
  • CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
  • CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
  • CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()
Record
CLSA-2026-1791539516
Updated
2026-11-02
OSVMGASA-2026-0578 No score

Updated gimp packages fix security vulnerabilities

This update to v. 3.2.8 fixes several security issues.

Record
MGASA-2026-0578
Updated
2026-11-07
OSVopenSUSE-SU-2026:21959-1 No score

Security update for gimp

This update for gimp fixes the following issues:

Changes in gimp:

  • CVE-2026-18304: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233)
  • CVE-2026-18301: GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276230)
  • CVE-2026-18307: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236)
  • CVE-2026-18303: GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276232)
  • CVE-2026-18308: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276237)
  • CVE-2026-18306: GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235)
  • CVE-2026-18305: GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234)
  • CVE-2026-18302: GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276231)
  • CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511)
  • CVE-2026-90948: When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size (bsc#1280512)
  • CVE-2026-92248: When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header (bsc#1280739)
Record
openSUSE-SU-2026:21959-1
Updated
2026-11-02
OSVSUSE-SU-2026:4409-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2026-18301: Vulnerability Report at read_channel_data (bsc#1276230).
  • CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow (bsc#1276231).
  • CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow (bsc#1276232).
  • CVE-2026-18304: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233).
  • CVE-2026-18305: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234).
  • CVE-2026-18306: SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235).
  • CVE-2026-18307: File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236).
  • CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511).
  • CVE-2026-90948: heap buffer overflow in the ICO loader when processing ICO files with embedded PNG images due to an integer overflow during calculation of buffer sizes (bsc#1280512).
  • CVE-2026-92248: integer overflow when generating a thumbnail preview for a PSD file can lead to a heap buffer overflow (bsc#1280739).
Record
SUSE-SU-2026:4409-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp-libs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
gimp-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
gimp-devel-tools
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
gimp-libs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
pygobject2
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
pygobject2-codegen
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
pygobject2-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
pygobject2-doc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.28.7-5.module_el8.10.0+4267+35168c80
2.28.7-5.module_el8.10.0+4267+35168c80
Show 70 moreShow less
Affected packages
PackageAffectedFixed
pygtk2
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-codegen
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-doc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
python2-cairo
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.16.3-7.module_el8.10.0+4267+35168c80
1.16.3-7.module_el8.10.0+4267+35168c80
python2-cairo-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.16.3-7.module_el8.10.0+4267+35168c80
1.16.3-7.module_el8.10.0+4267+35168c80
gimp
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9_6.2.tuxcare.els22
2:2.99.8-4.el9_6.2.tuxcare.els22
gimp-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9_6.2.tuxcare.els22
2:2.99.8-4.el9_6.2.tuxcare.els22
gimp-devel-tools
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9_6.2.tuxcare.els22
2:2.99.8-4.el9_6.2.tuxcare.els22
gimp-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9_6.2.tuxcare.els22
2:2.99.8-4.el9_6.2.tuxcare.els22
gimp
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9.2.tuxcare.els22
2:2.99.8-4.el9.2.tuxcare.els22
gimp-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9.2.tuxcare.els22
2:2.99.8-4.el9.2.tuxcare.els22
gimp-devel-tools
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9.2.tuxcare.els22
2:2.99.8-4.el9.2.tuxcare.els22
gimp-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 2:2.99.8-4.el9.2.tuxcare.els22
2:2.99.8-4.el9.2.tuxcare.els22
gimp
Debian:12
 All versions, plus listed versions
2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3
Show 45 moreShow less
2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2
 None known
gimp
Debian:13
 before 3.0.4-3+deb13u11, plus listed versions
3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u23.0.4-3+deb13u3
Show 6 moreShow less
3.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u9
3.0.4-3+deb13u11
gimp
Debian:14
 before 3.2.6-1, plus listed versions
3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1
Show 14 moreShow less
3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-3
3.2.6-1
gimp
Mageia:10
From an advisory covering 28 CVEs
 before 3.2.8-1.mga10
3.2.8-1.mga10
gimp
openEuler:24.03-LTS-SP4
From an advisory covering 3 CVEs
 before 3.2.6-1.oe2403sp4
3.2.6-1.oe2403sp4
gimp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp-devel-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 2:3.0.4-4.el9_8.14
2:3.0.4-4.el9_8.14
gimp
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
gimp-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
gimp-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
gimp-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
gimp-devel-tools
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
gimp-devel-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
gimp-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
gimp-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9
pygobject2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-codegen
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygtk2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-codegen
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
python2-cairo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-cairo-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-cairo-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-pycairo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-pycairo-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
gimp
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4
2:2.8.22-26.module+el8.10.0+40075+a21479b4.4
gimp
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+1927+52edb5a0
2:2.8.22-26.module+el8.10.0+1927+52edb5a0
gimp
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8
2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8
gimp
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
gimp
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6
2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6
gimp
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
gimp
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5
2:2.8.22-26.module+el8.10.0+40134+eab491b1.5
pygobject2
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2.28.7-5.module+el8.10.0+1927+52edb5a0
0:2.28.7-5.module+el8.10.0+1927+52edb5a0
pygtk2
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2.24.0-25.module+el8.9.0+1723+9bc93544
0:2.24.0-25.module+el8.9.0+1723+9bc93544
python2-pycairo
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.16.3-7.module+el8.10.0+1927+52edb5a0
0:1.16.3-7.module+el8.10.0+1927+52edb5a0
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 10 CVEs
 before 2.10.30-150400.3.79.1
2.10.30-150400.3.79.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 10 CVEs
 before 2.10.30-150400.3.79.1
2.10.30-150400.3.79.1
gimp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3
 None known
gimp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3
 None known
gimp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3
Show 5 moreShow less
2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3
Show 4 moreShow less
2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3
 None known
gimp
Ubuntu:26.10
 All versions, plus listed versions
3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1
 None known
gimp
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3
Show 7 moreShow less
3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1
 None known
gimp
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 3.0.8-bp160.10.1
3.0.8-bp160.10.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
affectedNVD, OSV
factsEUVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-90947 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 6, published September 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in gimp 3.0.4-3+deb13u11.

References

Show 74 moreShow less
This page doesn't list everything

Left out here: 8 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open