Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GIMP image editor can be remotely hijacked via HDR files
published 2 months ago
Summary
The GIMP graphics program, which uses the GEGL library, has a flaw in the way it reads HDR image files. A specially crafted HDR file could cause an error that lets an attacker run their own code on the computer. Install the latest GIMP update as soon as possible to fix the issue.
What to do
- Update almalinux gegl04 to version 0.4.4-7.el8_10.1.
- Update almalinux gegl04-devel to version 0.4.4-7.el8_10.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | gegl04 |
< 0.4.4-7.el8_10.1 Fix: upgrade to 0.4.4-7.el8_10.1
|
| AlmaLinux:8 | almalinux | gegl04-devel |
< 0.4.4-7.el8_10.1 Fix: upgrade to 0.4.4-7.el8_10.1
|
Original advisory text
Important: gegl04 security update
GEGL (Generic Graphics Library) is a graph-based image processing framework.
Security Fix(es):
* gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing (CVE-2026-18300)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing (CVE-2026-18300)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:62420 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-18300 Third Party Advisory
- https://bugzilla.redhat.com/2520587 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-62420.html Vendor Advisory
Timeline
Published2 Sep 2026
Updated2 Sep 2026
First seen2 Sep 2026
Sources
ALSA-2026:62420 · OSV
Track software like this
Free during beta