{"id":"CVE-2026-58384","aliases":["ALSA-2026:40751","CLSA-2026-1784021937","CLSA-2026-1784108403","DEBIAN-CVE-2026-58384","EUVD-2026-42020","GHSA-pp89-6qxc-wh8f","OESA-2026-3096","OESA-2026-3097","RHSA-2026:40751","RHSA-2026:73768","RHSA-2026:80509","UBUNTU-CVE-2026-58384"],"status":"published","title":"Gimp: gimp: integer overflow in read_rle_channel()","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00305,"percentile":0.23518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-07-07T07:44:28Z","modified":"2026-11-05T21:15:52Z","fixes":[{"ecosystem":"Debian:13","package":"gimp","fixed_in":["3.0.4-3+deb13u10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gimp","fixed_in":["3.2.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els12"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.34-1+deb12u1","2.10.34-1+deb12u10","2.10.34-1+deb12u2","2.10.34-1+deb12u3","2.10.34-1+deb12u4","2.10.34-1+deb12u5","2.10.34-1+deb12u6","2.10.34-1+deb12u7","2.10.34-1+deb12u8","2.10.34-1+deb12u9","2.10.36-1","2.10.36-2","2.10.36-3","2.10.38-1","2.10.38-2","2.99.10-1","2.99.12-1","2.99.12-2","2.99.14-1","2.99.14-2","2.99.16-1","2.99.16-2","2.99.18-1","3.0.0-1","3.0.0-2","3.0.0~RC1-1","3.0.0~RC1-3","3.0.0~RC1-4","3.0.0~RC2-1","3.0.0~RC3-1","3.0.2-1","3.0.2-2","3.0.2-3","3.0.2-3.1","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-3+deb13u10"}]}],"versions":["3.0.4-3","3.0.4-3+deb13u1","3.0.4-3+deb13u2","3.0.4-3+deb13u3","3.0.4-3+deb13u4","3.0.4-3+deb13u5","3.0.4-3+deb13u6","3.0.4-3+deb13u7","3.0.4-3+deb13u8","3.0.4-3+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1"}]}],"versions":["3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-16.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-16.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-devel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-devel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-devel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.14-1ubuntu2","2.8.14-1.2ubuntu1","2.8.16-1ubuntu1","2.8.16-1ubuntu1.1","2.8.16-1ubuntu1.1+esm1","2.8.16-1ubuntu1.1+esm2","2.8.16-1ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.20-1","2.8.20-1.1","2.8.20-2","2.8.22-1","2.8.22-1ubuntu0.1~esm1","2.8.22-1ubuntu0.1~esm2","2.8.22-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.8-2","2.10.14-2","2.10.14-2build1","2.10.14-2ubuntu1","2.10.14-3","2.10.18-1","2.10.18-1ubuntu0.1","2.10.18-1ubuntu0.1+esm1","2.10.18-1ubuntu0.1+esm2","2.10.18-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.24-2","2.10.28-1","2.10.30-1","2.10.30-1build1","2.10.30-1ubuntu0.1","2.10.30-1ubuntu0.1+esm1","2.10.30-1ubuntu0.1+esm2","2.10.30-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.36-1","2.10.36-2","2.10.36-3build2","2.10.36-3build3","2.10.36-3ubuntu0.24.04.1","2.10.36-3ubuntu0.24.04.1+esm1","2.10.36-3ubuntu0.24.04.1+esm2","2.10.36-3ubuntu0.24.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-1","3.0.2-2","3.0.2-3","3.0.2-3.1","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-5","3.0.4-6","3.0.4-6.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.0-1","3.2.2-1","3.2.2-1ubuntu0.26.04.1"]}],"products":[{"vendor":"gimp","product":"gimp"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:40751","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73768","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80509","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93589","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58384","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497431","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217","tags":["Broken Link","fix","article","report"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16216","tags":["Exploit","Issue Tracking","Vendor Advisory","report","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58384","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pp89-6qxc-wh8f"},{"url":"https://access.redhat.com/security/cve/CVE-2026-58380","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496135","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497431","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-40751.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784021937.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58380","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784108403.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58384.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-58384","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58379","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3097","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496135","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40751.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58380","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16206","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58384","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520594","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73768.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18301","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2772","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-454/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18302","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18302","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/77e1a11636fae53c922fe92273b8f4e33c7a9176","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-455/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18303","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/5633b362026c6e5b2beb559a10cd76fa32a47592","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-456/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18304","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/ad32d22c347674fa1bb5b60935c376b673d946e7","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-457/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18305","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/0a45a2b51b877829ef523131b50c0eb2a933b8a1","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-458/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18306","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/76531da9732f38566e5fd8f8f80c837158511ae5","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-459/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18307","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/bace3e7fd54104fe6b70c1703e9b982a4770811d","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-460/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58379","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16205","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59090","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-66758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66758","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66758","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16528","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80509.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-58384","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16216","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-58384","title":"Gimp: gimp: integer overflow in read_rle_channel()","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","status":"published","published":"2026-07-07T07:44:28.139Z","modified":"2026-11-02T09:58:49.228Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-42020","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","status":"published","published":"2026-07-07T07:44:28Z","modified":"2026-11-04T23:06:38Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-pp89-6qxc-wh8f","title":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an...","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","status":"published","published":"2026-07-07T09:37:54Z","modified":"2026-11-02T12:30:20Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:14:55.927217Z"}],"nvd":[{"id":"CVE-2026-58384","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","status":"published","published":"2026-07-07T09:16:30.003Z","modified":"2026-11-04T23:17:53.05Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T01:45:09.958441Z"}],"osv":[{"id":"CVE-2026-58384","title":"Gimp: gimp: integer overflow in read_rle_channel()","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","status":"published","published":"2026-07-07T07:44:28.139Z","modified":"2026-11-05T21:15:52.877018836Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"DEBIAN-CVE-2026-58384","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","status":"published","published":"2026-07-07T09:16:30.003Z","modified":"2026-11-05T10:01:06.960895175Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-3096","title":"gimp security update","description":"The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GIMP\u0026apos;s Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.(CVE-2026-58379)\n\nA flaw was found in GIMP\u0026apos;s PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.(CVE-2026-58380)\n\nA flaw was found in GIMP\u0026apos;s PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.(CVE-2026-58384)","status":"published","published":"2026-07-19T11:11:58Z","modified":"2026-08-18T01:21:20.91439566Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3097","title":"gimp security update","description":"The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GIMP\u0026apos;s Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.(CVE-2026-58379)\n\nA flaw was found in GIMP\u0026apos;s PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.(CVE-2026-58380)\n\nA flaw was found in GIMP\u0026apos;s PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.(CVE-2026-58384)","status":"published","published":"2026-07-19T11:11:59Z","modified":"2026-08-18T01:21:21.157163034Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:40751","title":"Red Hat Security Advisory: gimp security update","status":"published","published":"2026-07-17T10:09:44Z","modified":"2026-10-12T10:05:52Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:73768","title":"Red Hat Security Advisory: gimp security update","status":"published","published":"2026-10-01T10:21:02Z","modified":"2026-10-12T10:08:29Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:80509","title":"Red Hat Security Advisory: gimp security update","status":"published","published":"2026-10-14T10:31:47Z","modified":"2026-10-14T10:48:08.656415964Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-58384","description":"A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.","status":"published","published":"2026-07-07T09:16:00Z","modified":"2026-08-10T15:27:25.859756217Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:40751","title":"Important: gimp security update","description":"The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.  \n\nSecurity Fix(es):  \n\n  * gimp: gimp: Stack buffer overflow in pnmscanner_gettoken() (CVE-2026-58380)\n  * gimp: gimp: Integer overflow in read_RLE_channel() (CVE-2026-58384)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-16T00:00:00Z","modified":"2026-10-29T11:31:39.355594391Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1784021937","title":"gimp: Fix of 2 CVEs","description":"- CVE-2026-58380: fix out-of-bounds write in PNM parser by keeping the\n  pnmscanner_gettoken NUL terminator within bufsize - 1\n- CVE-2026-58384: fix integer overflow in PSD read_RLE_channel row-length\n  allocation with a g_size_checked_mul guard against G_MAXUINT32","status":"published","published":"2026-07-14T10:37:22Z","modified":"2026-10-26T09:30:12.047663034Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784108403","title":"gimp: Fix of 2 CVEs","description":"- CVE-2026-58380: fix out-of-bounds write in PNM parser by keeping the\n  pnmscanner_gettoken NUL terminator within bufsize - 1\n- CVE-2026-58384: fix integer overflow in PSD read_RLE_channel row-length\n  allocation with a g_size_checked_mul guard against G_MAXUINT32","status":"published","published":"2026-07-15T09:40:16Z","modified":"2026-10-26T09:31:17.841204498Z","updated_at":"2026-11-02T15:43:46.151924Z"}]}}