[From nobody Wed Nov  4 13:09:10 2026
Received: (at submit) by bugs.debian.org; 10 Oct 2026 09:06:42 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-107.3 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,
 FOURLA,FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST
 autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 12; hammy, 146; neutral, 34; spammy,
 0. spammytokens:
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <carnil@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:54100)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xFT2Q-005q4g-0f
 for submit@bugs.debian.org; Sat, 10 Oct 2026 09:06:41 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Content-Type:MIME-Version:Message-ID:
 Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=XX9+/2FxrDlzGzLjz+M9z58QWIqTT85edaFB0VcSgcE=; b=U6NbFPnphyAdAaICWXQM8QaM6X
 PEX6UYSqr5ZW8FQhyAEG3GrMNSD8GromtV/zgvGPJrMN2qMGhFC2ejDqzSgRFq7hmdrCGM7PGUmVk
 ssf1HgKiGK45xFnfaQZrx/gEYpveDwP5gh3VrOuXtObmdtulFe9X1TxvBl3KJquQLnBIMD/+XuOHF
 2NmwfMcC4we1wBTXx0f6HdDEmFKx2DFJOtvJU6A02xcvioQeH6YOyat+iSZZTmgzv/IorpL8XaCOQ
 HsEgBEblFXhJOlf+Y6NNLrqR0/Vv99P5mf4EuUWPjc0f46uk1QhSw3XRW0QeKyun3cfRBdepmWO26
 BwfZSvdw==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xFT2N-001CNb-11
 for submit@bugs.debian.org; Sat, 10 Oct 2026 09:06:40 +0000
Received: by eldamar.lan (Postfix, from userid 1000)
 id EB429DC0B1E; Sat, 10 Oct 2026 11:06:38 +0200 (CEST)
Date: Sat, 10 Oct 2026 11:06:38 +0200
From: Salvatore Bonaccorso <carnil@debian.org>
To: submit@bugs.debian.org
Subject: gimp: CVE-2026-108093
Message-ID: <asoAHjukcZgGfr_N@eldamar.lan>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Debian-User: carnil
Delivered-To: submit@bugs.debian.org

Source: gimp
Version: 3.2.6-1
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for gimp.

CVE-2026-108093[0]:
| A flaw was found in GIMP. The XCF loader processes image-simulation-
| intent and image-simulation-bpc parasites without ensuring the
| parasite data is present before dereferencing it. Opening a
| specially crafted XCF file with a zero-size simulation parasite can
| cause a NULL pointer dereference and crash the GIMP application.

Unfortunately the Red Hat bugzilla entry with possibly more details is
not yet open.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-108093
    https://www.cve.org/CVERecord?id=CVE-2026-108093
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2548607

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]