CVE-2026-42169 covers heap buffer overflows in the APNG and DDS image loaders of GIMP, triggered by opening a crafted image file. The record scores it 7.3 (High) and says code execution is possible. Red Hat ships fixes through errata for Enterprise Linux, so update the gimp package.
What's affected
The record describes a heap buffer overflow in GIMP's APNG loader, where the fcTL width exceeds the IHDR width, and a second overflow in the DDS plug-in caused by a bits per pixel mismatch in load_layer(). The record's product list is Red Hat Enterprise Linux and its Extended Update Support stream. It links three errata: RHSA-2026:50817, RHSA-2026:73768 and RHSA-2026:80509.
The Red Hat CVE page we read did not list package versions or errata, so we could not match errata to RHEL releases. Check which one applies to your release.
Source conflict to note: Red Hat's page gives 7.3 under CVSS 3.1 and notes that NVD scores it 7.8. The record's 7.3 matches Red Hat. Both are High.
Weakness class: CWE-131, incorrect calculation of buffer size.
How to check if you're exposed
On a RHEL machine, run rpm -q gimp to see whether GIMP is installed and which build. Then run dnf updateinfo info CVE-2026-42169 to see whether an advisory applies to your enabled repositories. If the package is not installed, you are not exposed through GIMP.
On workstations that are not RHEL, check your own distribution's tracker for the same CVE, since GIMP is packaged by everyone. Also check Flatpak and Snap installs of GIMP, which update separately from the system packages.
What to do now
- Update the gimp package on RHEL machines with the errata for your release, for example with
dnf update gimp. - Check Flatpak and Snap copies of GIMP and update them too.
- Remove GIMP from servers and build hosts that do not need an image editor.
- Until updated, avoid opening APNG or DDS images from untrusted sources. Red Hat says no official mitigation is available, and this is our general advice.
- If you process user images with GIMP in a script or pipeline, move that work to a sandboxed environment.
Why it matters
Both flaws are heap buffer overflows in file format parsers. The program trusts a size taken from the file, such as a width, and then writes more data than it allocated. The record says opening a specially crafted image file can lead to code execution, and the attack needs a user to open the file, so it comes through email attachments, downloads and shared folders.
Image editors are often forgotten in patch programs because they are desktop tools, but they parse complex formats from untrusted sources all the time. The KEV flag is false and neither the record nor Red Hat reports exploitation.
Try it yourself
When a fix already exists in your distribution, the work is mostly finding what needs it. This demo shows that flow.
Click through it at your own pace, or open it full screen.
Quick check
Does the attack need a user to open a file?
Yes. The record's vector includes user interaction and a local attack vector.
Where is the fix?
Red Hat errata listed in the record. Confirm with dnf updateinfo for your release.
Sources
Last reviewed: 18 October 2026.
