CVE-2026-2046
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A vulnerability classified as critical was found in GIMP (Image Processing Software) (version now known).The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem.(CVE-2026-2046)
(CVE-2026-4152)
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
OSV Score usedOESA-2026-1710
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A vulnerability classified as critical was found in GIMP (Image Processing Software) (version now known).The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem.(CVE-2026-2046)
(CVE-2026-4152)
- Record
OESA-2026-1710- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-1711
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A vulnerability classified as critical was found in GIMP (Image Processing Software) (version now known).The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem.(CVE-2026-2046)
(CVE-2026-4152)
- Record
OESA-2026-1711- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-1712
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A vulnerability classified as critical was found in GIMP (Image Processing Software) (version now known).The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem.(CVE-2026-2046)
(CVE-2026-4152)
- Record
OESA-2026-1712- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-1713
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A vulnerability classified as critical was found in GIMP (Image Processing Software) (version now known).The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem.(CVE-2026-2046)
(CVE-2026-4152)
- Record
OESA-2026-1713- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-2046 No score
[Unknown description]
- Record
UBUNTU-CVE-2026-2046- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:12 |
All versions, plus listed versions 2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3 Show 45 moreShow less2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2 |
None known |
gimpDebian:13 |
All versions, plus listed versions 3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u23.0.4-3+deb13u3 Show 24 moreShow less3.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u93.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-3 |
None known |
gimpDebian:14 |
before 3.2.0-1, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 9 moreShow less3.0.4-6.23.0.6-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-1 |
3.2.0-1 |
gimpopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 3.0.2-11.oe2403 | 3.0.2-11.oe2403 |
gimpopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 3.0.2-11.oe2403sp1 | 3.0.2-11.oe2403sp1 |
gimpopenEuler:24.03-LTS-SP2 From an advisory covering 2 CVEs |
before 3.0.2-11.oe2403sp2 | 3.0.2-11.oe2403sp2 |
gimpopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 3.0.2-11.oe2403sp3 | 3.0.2-11.oe2403sp3 |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 |
None known |
gimpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gimpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 |
None known |
gimpUbuntu:25.10 |
All versions, plus listed versions 3.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-1 Show 5 moreShow less3.0.4-23.0.4-33.0.4-53.0.4-63.0.4-6.1 |
None known |
gimpUbuntu:26.10 |
All versions, plus listed versions 3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 |
None known |
gimpUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-2046 is a high vulnerability (CVSS 7.8) in gimp, published January 1, 0001. No source lists public exploit code. Fixed in gimp 3.2.0-1.
References
security-tracker.debian.org/tracker/CVE-2026-2046
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1710
nvd.nist.gov/vuln/detail/CVE-2026-2046
Left out here: 6 versions. The JSON record has them.