CVE-2026-97185
Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- Record
CVE-2026-97185- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-85817
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- Record
EUVD-2026-85817- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-wp8m-4297-94hv
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the...
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- Record
GHSA-wp8m-4297-94hv- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- Record
CVE-2026-97185- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-97185
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- Record
DEBIAN-CVE-2026-97185- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVRHSA-2026:75575
Red Hat Security Advisory: gimp security update
- Record
RHSA-2026:75575- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVRHSA-2026:84744
Red Hat Security Advisory: gimp:2.8 security update
- Record
RHSA-2026:84744- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:84744
Important: gimp:2.8 security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
-
gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
-
gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
-
gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
-
gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:84744- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-97185
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- Record
UBUNTU-CVE-2026-97185- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:75575 No score
Important: gimp security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
- gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
- gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
- gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
- gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:75575- Updated
- 2026-11-02
OSVALSA-2026:84744 No score
Important: gimp:2.8 security update
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
- gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947)
- gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948)
- gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248)
- gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:84744- Updated
- 2026-11-02
OSVCLSA-2026-1791479721 No score
gimp: Fix of 10 CVEs
- CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
- CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
- CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
- CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()
- Record
CLSA-2026-1791479721- Updated
- 2026-11-02
OSVCLSA-2026-1791539516 No score
gimp: Fix of 4 CVEs
- CVE-2026-90948: compute the ICO PNG frame size and the image buffer size with g_size_checked_mul () in ico_read_png () and ico_load_image ()
- CVE-2026-90947: clamp the preset "Number of lights" to NUM_LIGHTS in the Lighting Effects load_preset_response ()
- CVE-2026-92248: bound the PSD JPEG thumbnail dimensions and compute its buffer size with g_size_checked_mul () in load_resource_1033 ()
- CVE-2026-97185: reject out-of-range vector indices in the GIMPressionist preset loader set_orient_vector () and set_size_vector ()
- Record
CLSA-2026-1791539516- Updated
- 2026-11-02
OSVMGASA-2026-0578 No score
Updated gimp packages fix security vulnerabilities
This update to v. 3.2.8 fixes several security issues.
- Record
MGASA-2026-0578- Updated
- 2026-11-07
OSVopenSUSE-SU-2026:12082-1 No score
gimp-3.2.6-4.1 on GA media
These are all security issues fixed in the gimp-3.2.6-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12082-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22025-1 No score
Security update for gimp
This update for gimp fixes the following issues:
Changes in gimp:
- CVE-2026-96546: one-byte out-of-bounds heap read in the uncompressed DDS loader (bsc#1282601)
- CVE-2026-97185: out-of-bounds write in GIMPressionist plugin via crafted preset file (bsc#1282596)
- Record
openSUSE-SU-2026:22025-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4653-1 No score
Security update for gimp
This update for gimp fixes the following issue:
- CVE-2026-97185: out-of-bounds write in GIMPressionist plugin via crafted preset file (bsc#1282596).
- Record
SUSE-SU-2026:4653-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpAlmaLinux:9 From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-libsAlmaLinux:9 From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimpAlmaLinux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
gimp-develAlmaLinux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
gimp-devel-toolsAlmaLinux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
gimp-libsAlmaLinux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 | 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9 |
pygobject2AlmaLinux:8 From an advisory covering 4 CVEs |
before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-codegenAlmaLinux:8 From an advisory covering 4 CVEs |
before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-develAlmaLinux:8 From an advisory covering 4 CVEs |
before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
pygobject2-docAlmaLinux:8 From an advisory covering 4 CVEs |
before 2.28.7-5.module_el8.10.0+4267+35168c80 | 2.28.7-5.module_el8.10.0+4267+35168c80 |
Show 70 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pygtk2AlmaLinux:8 From an advisory covering 4 CVEs |
before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-codegenAlmaLinux:8 From an advisory covering 4 CVEs |
before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-develAlmaLinux:8 From an advisory covering 4 CVEs |
before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
pygtk2-docAlmaLinux:8 From an advisory covering 4 CVEs |
before 2.24.0-25.module_el8.9.0+3725+d1441900 | 2.24.0-25.module_el8.9.0+3725+d1441900 |
python2-cairoAlmaLinux:8 From an advisory covering 4 CVEs |
before 1.16.3-7.module_el8.10.0+4267+35168c80 | 1.16.3-7.module_el8.10.0+4267+35168c80 |
python2-cairo-develAlmaLinux:8 From an advisory covering 4 CVEs |
before 1.16.3-7.module_el8.10.0+4267+35168c80 | 1.16.3-7.module_el8.10.0+4267+35168c80 |
gimpTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimp-develTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimp-devel-toolsTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimp-libsTuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9_6.2.tuxcare.els22 | 2:2.99.8-4.el9_6.2.tuxcare.els22 |
gimpTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimp-develTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimp-devel-toolsTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimp-libsTuxCare:AlmaLinux:9.2 From an advisory covering 4 CVEs |
before 2:2.99.8-4.el9.2.tuxcare.els22 | 2:2.99.8-4.el9.2.tuxcare.els22 |
gimpDebian:12 |
All versions, plus listed versions 2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3 Show 45 moreShow less2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2 |
None known |
gimpDebian:13 |
All versions, plus listed versions 3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u113.0.4-3+deb13u2 Show 27 moreShow less3.0.4-3+deb13u33.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u93.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-13.2.8-1 |
None known |
gimpDebian:14 |
All versions, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 16 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-13.2.8-1 |
None known |
gimpMageia:10 From an advisory covering 28 CVEs |
before 3.2.8-1.mga10 | 3.2.8-1.mga10 |
gimpRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-libsRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimp-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs |
before 2:3.0.4-4.el9_8.14 | 2:3.0.4-4.el9_8.14 |
gimpRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-devel-toolsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-devel-tools-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-libsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
gimp-libs-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 | 2:2.8.22-26.module+el8.10.0+25091+9b86bd7c.9 |
pygobject2Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-codegenRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygobject2-docRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 |
pygtk2Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-codegenRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
pygtk2-docRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d |
python2-cairoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-cairo-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-cairo-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-pycairoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
python2-pycairo-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 |
gimpRocky Linux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 | 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4 |
gimpRocky Linux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 | 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 |
gimpRocky Linux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 | 2:2.8.22-26.module+el8.10.0+40308+ebf9d253.8 |
gimpRocky Linux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 | 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3 |
gimpRocky Linux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 | 2:2.8.22-26.module+el8.10.0+40181+ad0e3a65.6 |
gimpRocky Linux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 | 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2 |
gimpRocky Linux:8 From an advisory covering 4 CVEs |
before 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 | 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5 |
pygobject2Rocky Linux:8 From an advisory covering 4 CVEs |
before 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 | 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 |
pygtk2Rocky Linux:8 From an advisory covering 4 CVEs |
before 0:2.24.0-25.module+el8.9.0+1723+9bc93544 | 0:2.24.0-25.module+el8.9.0+1723+9bc93544 |
python2-pycairoRocky Linux:8 From an advisory covering 4 CVEs |
before 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 | 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 |
gimpSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 2.10.30-150400.3.82.1 | 2.10.30-150400.3.82.1 |
gimpSUSE:Linux Enterprise Workstation Extension 15 SP7 |
before 2.10.30-150400.3.82.1 | 2.10.30-150400.3.82.1 |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 |
None known |
gimpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 |
None known |
gimpUbuntu:26.10 |
All versions, plus listed versions 3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 |
None known |
gimpUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 |
None known |
gimpopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.2.6-4.1 | 3.2.6-4.1 |
gimpopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 3.0.8-bp160.12.1 | 3.0.8-bp160.12.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| affected | NVD, OSV | |
| facts | EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97185 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in gimp 2.10.30-150400.3.82.1.
References
access.redhat.com/errata/RHSA-2026:75575
bugzilla.redhat.com/show_bug.cgi?id=2539980
gitlab.gnome.org/GNOME/gimp/-/work_items/16788
Show 53 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-97185
github.com/advisories/GHSA-wp8m-4297-94hv
errata.almalinux.org/9/ALSA-2026-75575.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791479721.html
security-tracker.debian.org/tracker/CVE-2026-97185
advisories.mageia.org/MGASA-2026-0578.html
bugs.mageia.org/show_bug.cgi?id=36194
lists.opensuse.org/archives/list/[email protected]/message/LUXP5VNBOZ64AC65YKLO3MBCA4XXR3YS
lists.debian.org/debian-security-announce/2026/msg00381.html
gimp.org/news/2026/09/10/gimp-3-2-6-released
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75575.json
cve.org/CVERecord?id=CVE-2026-90947
errata.rockylinux.org/RLSA-2026:84744
suse.com/support/update/announcement/2026/suse-su-20264653-1
bugzilla.suse.com/1282596
ubuntu.com/security/CVE-2026-97185
Left out here: 8 versions. The JSON record has them.