Amazon Linux 2 Security Advisory: ALAS2GIMP-2026-013
Advisory Released Date: 2026-04-14
Advisory Updated Date: 2026-04-14
A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP's PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS). (CVE-2026-4887)
Affected Packages:
gimp
Note:
This advisory is applicable to Amazon Linux 2 - Gimp Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update gimp or yum update --advisory ALAS2GIMP-2026-013 to update your system.
src:
gimp-2.8.22-1.amzn2.0.13.src
x86_64:
gimp-2.8.22-1.amzn2.0.13.x86_64
gimp-libs-2.8.22-1.amzn2.0.13.x86_64
gimp-devel-2.8.22-1.amzn2.0.13.x86_64
gimp-devel-tools-2.8.22-1.amzn2.0.13.x86_64
gimp-debuginfo-2.8.22-1.amzn2.0.13.x86_64