This update for gimp fixes the following issues:
- CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads
(bsc#1277618).
- CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads
(bsc#1277622).
- CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when
generating a thumbnail for a crafted XMC file (bsc#1284473).
- CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image
(bsc#1284474).
- CVE-2026-106063: heap-based buffer
This update for gimp fixes the following issues:
Security issues fixed:
- CVE-2026-59088: denial of service via signed integer overflow in FLI file processing (bsc#1274837).
- CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).
- CVE-2026-66757: signed integer overflow in `file-sgi` causes the plugin to crash when RLE-compressed SGI images are
processed (bsc#1273151).
- CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations
(bsc#1277378).
- CVE-2026-80101: independent header field validation in the XWD loader can cause heap out-of-bounds
This update for gimp fixes the following issues:
- CVE-2026-59088: GIMP: Denial of service via signed integer overflow in FLI file processing (bsc#1274837).
- CVE-2026-59090: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).
This update for gimp fixes the following issues
- CVE-2026-58379: Heap buffer overflow in read_channel_data() (bsc#1270299).
- CVE-2026-58380: Stack buffer overflow in pnmscanner_gettoken() (bsc#1270444).
- CVE-2026-58381: double-free in read_layer_block() (bsc#1270239).
This update for gimp fixes the following issue:
- CVE-2026-4887: Memory disclosure and denial of service via specially crafted PCX image (bsc#1260837).
This update for gimp fixes the following issues:
- CVE-2026-2044: lack of proper initialization of memory can allow remote attackers to execute arbitrary code
(bsc#1258532).
- CVE-2026-2045: check offset in the colormap is valid before using it (bsc#1258533).
- CVE-2026-2048: lack of proper validation of user-supplied data can allow remote attackers to execute arbitrary code
(bsc#1258535).
This update for gimp fixes the following issues:
- CVE-2026-2272: integer overflow in ICO file handling can lead to a heap buffer overflow (bsc#1258000).
- CVE-2026-2271: integer overflow in the PSP file parser can lead to a heap buffer overflow (bsc#1257999).
- CVE-2026-2239: missing null terminator when processing a specially crafted PSD file can lead to a heap buffer
overflow and an application crash (bsc#1257959).
This update for gimp fixes the following issues:
- CVE-2025-14422: Fixed RCE vulnerability due to PNM file parsing integer overflow (bsc#1255293)
- CVE-2025-14425: Fixed RCE vulnerability due to JP2 file parsing heap-based buffer overflow (bsc#1255296)
This update for gimp fixes the following issues:
- CVE-2025-15059: Fixed Heap-based Buffer Overflow Remote Code Execution Vulnerability in GIMP PSP File Parsing (bsc#1255766).
This update for gimp fixes the following issues:
- CVE-2025-2760: lack of proper validation of user-supplied data in DDS parser can lead to integer overflow and remote
code execution (bsc#1241690).
This update for gimp fixes the following issues:
- CVE-2025-48797: Fixed two buffer over-reads and one heap-based buffer overflow in its TGA parser (bsc#1243711).
- CVE-2025-48798: Fixed two use-after-free bugs and one double free bug in its XCF parser (bsc#1243712).
This update for gimp fixes the following issues:
- CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write (bsc#1241691).