Amazon Linux 2 (EOS) Security Advisory: ALAS2GIMP-2026-017
Advisory Released Date: 2026-08-17
Advisory Updated Date: 2026-08-17
A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution. (CVE-2026-40915)
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service. (CVE-2026-66758)
Affected Packages:
gimp
Note:
This advisory is applicable to Amazon Linux 2 - Gimp Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update gimp or yum update --advisory ALAS2GIMP-2026-017 to update your system.
src:
gimp-2.8.22-1.amzn2.0.15.src
x86_64:
gimp-2.8.22-1.amzn2.0.15.x86_64
gimp-libs-2.8.22-1.amzn2.0.15.x86_64
gimp-devel-2.8.22-1.amzn2.0.15.x86_64
gimp-devel-tools-2.8.22-1.amzn2.0.15.x86_64
gimp-debuginfo-2.8.22-1.amzn2.0.15.x86_64