# CVE-2026-90947: Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

Status: published. Published: 2026-09-14. Updated: 2026-11-02.

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

## Remediation

- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 8 (gimp:2.8): ≥ 8100020261015094823.4c9c024f; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (gimp): ≥ 2:3.0.4-4.el9_8.14; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (gimp): ≥ 2:2.99.8-4.el9_2.7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (gimp): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (gimp): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.13% as of 2026-11-01; percentile 2.80%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-787

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:75575 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:84744 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:93589 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-90947 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2533005 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16682 (CNA: redhat)

- https://access.redhat.com/errata/RHSA-2026:75575 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:84744 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:93589 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-90947 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2533005 (secalert@redhat.com)

- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16682 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-90947; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90947; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-90947; retrieved 2026-11-02; source updated Not reported

Revision: 484b5a4797b19ec937ca0b2573be0c7b59a1d7166f1a9c04917755756b6a3990

Canonical: https://y2.dev/cve/CVE-2026-90947