GIMP Vulnerabilities Allow Remote Code Execution

CERT-Bund has released Security Advisory WID-SEC-2026-0750 detailing critical vulnerabilities in the Gnu Image Manipulation Program (GIMP). The advisory, with a CVSS Base Score of 7.8 (High), indicates that remote, anonymous attackers can exploit these flaws to execute arbitrary program code on systems running Linux, UNIX, or Windows. The advisory notes that mitigation is available, but does not specify the exact nature of the mitigation or affected versions beyond 'Open Source GIMP' as of March 16, 2026.

Organizations utilizing GIMP, particularly those distributing it as part of Linux distributions or using it on Windows and UNIX systems, should immediately assess their exposure. While the advisory indicates mitigation is available, users are strongly advised to consult the provided CVE and information links for specific details on patching or mitigating these vulnerabilities. Failure to address these issues could lead to unauthorized code execution and potential system compromise. The advisory does not specify a compliance deadline, but prompt action is recommended due to the severity of the vulnerabilities.