A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pygobject2-codegenUpgrade gimp-devel-toolsUpgrade pygobject2Upgrade gimp-libsUpgrade pygtk2-develUpgrade pygobject2-docUpgrade python2-cairo-develUpgrade gimpUpgrade pygtk2-docUpgrade pygtk2-codegenUpgrade python2-cairoUpgrade pygobject2-develUpgrade gimp-develUpgrade pygtk2 | Oct 11, 2026 | Oct 5, 2026 |
| Amazon Linux Ami 2 | — | Upgrade gimp-debuginfoUpgrade gimp-libsUpgrade gimpUpgrade gimp-devel-toolsUpgrade gimp-devel | Oct 19, 2026 | Oct 19, 2026 |
| Debian | — | Upgrade gimp | Sep 21, 2026 | Sep 14, 2026 |
| Oracle_linux | — | Upgrade gimp-libsUpgrade pygobject2-develUpgrade python2-cairoUpgrade gimp-develUpgrade pygobject2-docUpgrade pygtk2Upgrade pygobject2-codegenUpgrade gimpUpgrade pygtk2-develUpgrade pygtk2-codegenUpgrade pygobject2Upgrade gimp-devel-toolsUpgrade python2-cairo-develUpgrade pygtk2-doc | Oct 22, 2026 | Sep 14, 2026 |
| Redhat_linux | — | Upgrade gimp-libs-debuginfoUpgrade gimp-debuginfoUpgrade pygobject2-debugsourceUpgrade pygobject2-debuginfoUpgrade pygtk2-docUpgrade pygtk2-debuginfoUpgrade gimpUpgrade pygtk2-develUpgrade python2-cairoUpgrade gimp-devel-tools-debuginfoUpgrade gimp-debugsourceUpgrade pygobject2-docUpgrade python2-pycairo-debugsourceUpgrade python2-cairo-develUpgrade gimp-develNo solution existsUpgrade python2-cairo-debuginfoUpgrade pygtk2-codegenUpgrade pygobject2Upgrade gimp-libsUpgrade pygobject2-codegenUpgrade pygtk2Upgrade pygtk2-debugsourceUpgrade gimp-devel-toolsUpgrade pygobject2-devel | Sep 16, 2026 | Sep 14, 2026 |
| Rocky_linux | — | Upgrade gimp-debugsourceUpgrade gimp-devel-toolsUpgrade python2-pycairo-debugsourceUpgrade python2-cairoUpgrade gimp-develUpgrade pygobject2-codegenUpgrade pygtk2Upgrade pygtk2-debuginfoUpgrade python2-cairo-debuginfoUpgrade pygobject2-docUpgrade pygobject2-debuginfoUpgrade gimp-libsUpgrade gimp-libs-debuginfoUpgrade pygobject2-develUpgrade pygtk2-develUpgrade gimp-devel-tools-debuginfoUpgrade python2-cairo-develUpgrade pygtk2-codegenUpgrade pygtk2-debugsourceUpgrade gimpUpgrade gimp-debuginfoUpgrade pygobject2-debugsourceUpgrade pygobject2 | Oct 21, 2026 | Oct 20, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub