Every CVE Search/ Get API key

CVE-2022-32990

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an...

5.5 MediumFix available

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.67%Down 0.2 points since Jun 25, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Record
CVE-2022-32990
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-755
Updated
2026-11-02
CVE List No score

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Record
CVE-2022-32990
Updated
2026-11-02
EUVDEUVD-2022-36056 No score

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Record
EUVD-2022-36056
Updated
2026-11-03
GitHub AdvisoriesGHSA-fj77-3fg4-77vh 5.5

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an...

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Record
GHSA-fj77-3fg4-77vh
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-755
Updated
2026-11-02
OSVDEBIAN-CVE-2022-32990 5.5

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Record
DEBIAN-CVE-2022-32990
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVOESA-2026-2881 7.8

gimp security update

Security Fix(es):

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).(CVE-2022-32990)

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28807.(CVE-2026-4150)

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28874.(CVE-2026-4153)

Record
OESA-2026-2881
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVRHSA-2022:7978 6.2

Red Hat Security Advisory: gimp security and enhancement update

Record
RHSA-2022:7978
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2022:7978 6.2

Moderate: gimp security and enhancement update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: buffer overflow through a crafted XCF file (CVE-2022-30067)

  • gimp: unhandled exception via a crafted XCF file may lead to DoS (CVE-2022-32990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Record
RLSA-2022:7978
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-32990 5.5

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Record
UBUNTU-CVE-2022-32990
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2022:7978 No score

Moderate: gimp security and enhancement update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: buffer overflow through a crafted XCF file (CVE-2022-30067)
  • gimp: unhandled exception via a crafted XCF file may lead to DoS (CVE-2022-32990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:7978
Updated
2026-11-02
OSV No score

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Record
CVE-2022-32990
Updated
2026-11-02
OSVMGASA-2022-0330 No score

Updated gimp packages fix security vulnerability

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS). (CVE-2022-32990)

Record
MGASA-2022-0330
Updated
2026-11-02
OSVopenSUSE-SU-2024:14534-1 No score

gimp-2.10.38-4.1 on GA media

These are all security issues fixed in the gimp-2.10.38-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14534-1
Updated
2026-11-02
OSVSUSE-SU-2022:2867-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2022-32990: Fixed an unhandled exception which may lead to denial of service (bsc#1201192).
Record
SUSE-SU-2022:2867-1
Updated
2026-11-02
OSVSUSE-SU-2022:3106-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2022-32990: Fixed an unhandled exception which may lead to denial of service (bsc#1201192).
Record
SUSE-SU-2022:3106-1
Updated
2026-11-02
OSVSUSE-SU-2022:3107-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2022-32990: Fixed an unhandled exception which may lead to denial of service (bsc#1201192).
Record
SUSE-SU-2022:3107-1
Updated
2026-11-02
OSVUSN-6521-1 No score

gimp vulnerabilities

It was discovered that GIMP incorrectly handled certain image files. If a user were tricked into opening a specially crafted image, an attacker could use this issue to cause GIMP to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-6521-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-libs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp
Debian:12
 before 2.10.32-1
2.10.32-1
gimp
Debian:13
 before 2.10.32-1
2.10.32-1
gimp
Debian:14
 before 2.10.32-1
2.10.32-1
gimp
Mageia:8
 before 2.10.24-1.2.mga8
2.10.24-1.2.mga8
gimp
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 2.10.6-23.oe2003sp4
2.10.6-23.oe2003sp4
gimp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
Show 19 moreShow less
Affected packages
PackageAffectedFixed
gimp-devel-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp
Rocky Linux:9
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.8.18-9.24.1
2.8.18-9.24.1
gimp
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 2.8.18-9.24.1
2.8.18-9.24.1
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP4
 before 2.10.30-150400.3.6.2
2.10.30-150400.3.6.2
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP4
 before 2.10.30-150400.3.6.2
2.10.30-150400.3.6.2
gimp
openSUSE:Leap 15.4
 before 2.10.30-150400.3.6.2
2.10.30-150400.3.6.2
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP3
 before 2.10.12-150300.9.6.1
2.10.12-150300.9.6.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP3
 before 2.10.12-150300.9.6.1
2.10.12-150300.9.6.1
gimp
openSUSE:Leap 15.3
 before 2.10.12-150300.9.6.1
2.10.12-150300.9.6.1
gimp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3
 None known
gimp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3
 None known
gimp
Ubuntu:20.04:LTS
 before 2.10.18-1ubuntu0.1, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-32.10.18-1
2.10.18-1ubuntu0.1
gimp
Ubuntu:22.04:LTS
 before 2.10.30-1ubuntu0.1, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build1
2.10.30-1ubuntu0.1
gimp
Ubuntu:20.04:LTS
From an advisory covering 6 CVEs
 before 2.10.18-1ubuntu0.1, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-32.10.18-1
2.10.18-1ubuntu0.1
gimp
Ubuntu:22.04:LTS
From an advisory covering 6 CVEs
 before 2.10.30-1ubuntu0.1, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build1
2.10.30-1ubuntu0.1
gimp
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.10.38-4.1
2.10.38-4.1

History

History
RecordedChangedSources
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-32990 is a medium vulnerability (CVSS 5.5) in Gimp, published June 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in gimp 2.10.32-1.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open