https://security-tracker.debian.org/tracker/source-package/gimp
This page 'open issues' lists the CVEs with links, but I could not pin down any patches except these 3 (all similar)  "fix #12790 for 32-bit":
https://gitlab.gnome.org/GNOME/gimp/-/commit/12e1ab6b49ac941c6ff0c0a8cfad2a371a109ba1
https://gitlab.gnome.org/GNOME/gimp/-/commit/1e0f8fbee0adb62bb32d28b68b73db82f1127ecc
https://gitlab.gnome.org/GNOME/gimp/-/commit/d9977143f32bd0f3c18a57b2d6c260344924d251
I always lookf for gitlab links.

Complicated.

Assignee: bugsquad => pkg-bugs

openSUSE has issued an advisory on June 30:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DVVZTOVQSBY5ON5P7HYQIXK2OLMSUEH5/

Cauldron fixed those issues.

Debian has issued an advisory on November 3:
https://lists.debian.org/debian-lts-announce/2025/11/msg00005.html

Source RPM: gimp-3.0.4-1.mga10.src.rpm, gimp3-2.99.14-4.mga9.src.rpm, gimp-2.10.36-1.mga9.src.rpm => gimp3-2.99.14-4.mga9.src.rpm, gimp-2.10.36-1.mga9.src.rpm
CVE: CVE-2025-2760, CVE-2025-2761, CVE-2025-48797, CVE-2025-48798 => CVE-2025-2760, CVE-2025-2761, CVE-2025-48797, CVE-2025-48798, CVE-2025-10934
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9
Summary: gimp new security issues CVE-2025-276[01], CVE-2025-4879[78] => gimp new security issues CVE-2025-276[01], CVE-2025-4879[78], CVE-2025-10934

Debian has issued an advisory on January 4:
https://lists.debian.org/debian-security-announce/2026/msg00001.html

CVE: CVE-2025-2760, CVE-2025-2761, CVE-2025-48797, CVE-2025-48798, CVE-2025-10934 => CVE-2025-2760, CVE-2025-2761, CVE-2025-48797, CVE-2025-48798, CVE-2025-10934, CVE-2025-14422, CVE-2025-14424, CVE-2025-14425
Summary: gimp new security issues CVE-2025-276[01], CVE-2025-4879[78], CVE-2025-10934 => gimp new security issues CVE-2025-276[01], CVE-2025-4879[78], CVE-2025-10934, CVE-2025-1442[245]

CVE-2025-14424 only affects gimp3.

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. (CVE-2025-2760)

FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. (CVE-2025-2761)

Multiple heap buffer overflows in tga parser. (CVE-2025-48797)

Multiple use after free in xcf parser. (CVE-2025-48798)

XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-10934)

PNM File Parsing Integer Overflow Remote Code Execution Vulnerability. (CVE-2025-14422)

JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-14425)

References:
https://lists.debian.org/debian-security-announce/2025/msg00103.html
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DVVZTOVQSBY5ON5P7HYQIXK2OLMSUEH5/
https://lists.debian.org/debian-lts-announce/2025/11/msg00005.html
https://lists.debian.org/debian-security-announce/2026/msg00001.html
========================

Updated packages in core/updates_testing:
========================
gimp-2.10.36-1.1.mga9
lib(64)gimp2.0_0-2.10.36-1.1.mga9
lib(64)gimp2.0-devel-2.10.36-1.1.mga9

from SRPM:
gimp-2.10.36-1.1.mga9.src.rpm

Status comment: Patches available from Debian => (none)
Status: NEW => ASSIGNED
Assignee: pkg-bugs => qa-bugs

Installed and tested without issues.

Did some basic testing (e.g. opened images in various formats, did some editing, applied some filters, saved to various formats) and nothing seems to be broken.



System: Mageia 9, x86_64, Plasma DE, AMD Ryzen 5 5600G with Radeon Graphics using amdgpu driver.



$ uname -a
Linux jupiter 6.6.116-desktop-1.mga9 #1 SMP PREEMPT_DYNAMIC Mon Nov  3 15:35:03 UTC 2025 x86_64 GNU/Linux
$ rpm -qa | grep -P 'gimp.*2\.10\.36' | sort -u
gimp-2.10.36-1.1.mga9
lib64gimp2.0_0-2.10.36-1.1.mga9

CC: (none) => mageia

MGA9-64 server Plasma Wayland on Compaq H000SB.
No installation issues.
Opened color jpg file and used color to gray transformation. Exported generated image back to jpg and dispalyed it OK in gwenview.
In view of test above Comment 7, good to go.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0012.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED