Amazon Linux 2 Security Advisory: ALAS2GIMP-2026-018
Advisory Released Date: 2026-08-17
Advisory Updated Date: 2026-08-17
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service. (CVE-2026-66757)
Affected Packages:
gimp
Note:
This advisory is applicable to Amazon Linux 2 - Gimp Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update gimp or yum update --advisory ALAS2GIMP-2026-018 to update your system.
src:
gimp-2.8.22-1.amzn2.0.17.src
x86_64:
gimp-2.8.22-1.amzn2.0.17.x86_64
gimp-libs-2.8.22-1.amzn2.0.17.x86_64
gimp-devel-2.8.22-1.amzn2.0.17.x86_64
gimp-devel-tools-2.8.22-1.amzn2.0.17.x86_64
gimp-debuginfo-2.8.22-1.amzn2.0.17.x86_64