[Pkg-gnome-extras-maintainers] Bug#1150497: gimp: CVE-2026-108093

[Salvatore Bonaccorso]

Source: gimp
Version: 3.2.6-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for gimp.

CVE-2026-108093[0]:
| A flaw was found in GIMP. The XCF loader processes image-simulation-
| intent and image-simulation-bpc parasites without ensuring the
| parasite data is present before dereferencing it. Opening a
| specially crafted XCF file with a zero-size simulation parasite can
| cause a NULL pointer dereference and crash the GIMP application.

Unfortunately the Red Hat bugzilla entry with possibly more details is
not yet open.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-108093
    https://www.cve.org/CVERecord?id=CVE-2026-108093
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2548607

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore