Red Hat GIMP Update Addresses Thirteen RHEL 9 Vulnerabilities
Tech GuruQuick Answer
Red Hat published RHSA-2026:80509 for GIMP on RHEL 9.4 Extended Update Support. Match entitled systems to the exact advisory relationships, install gimp 2.99.8-4.el9_4.19 and the matching advisory-listed packages, validate dependent operations, and retain evidence.
Validate scope and apply the branch-specific Red Hat fix
What to do now: Inventory GIMP on RHEL 9.4 Extended Update Support, compare installed NEVRAs with the exact advisory product relationships, install the supported package for each entitled branch, validate representative services, and document exceptions.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | GIMP on RHEL 9.4 Extended Update Support |
|---|---|
| Advisory | RHSA-2026:80509 |
| CVEs | CVE-2026-18301, CVE-2026-18302, CVE-2026-18303, CVE-2026-18304, CVE-2026-18305, CVE-2026-18306, CVE-2026-18307, CVE-2026-42169, CVE-2026-58379, CVE-2026-58380, CVE-2026-58384, CVE-2026-59090, CVE-2026-66758 |
| Authoritative release date | 2026-10-12 02:07:10 UTC |
| Authority revision date | 2026-10-12 02:14:36 UTC |
| Affected versions | The entitled RHEL 9.4 EUS GIMP package relationship identified by RHSA-2026:80509. |
| Fixed version | gimp 2.99.8-4.el9_4.19 and the matching advisory-listed packages |
| CVSS base score | 7.3 / 7.8 / 8.4 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Red Hat published branch-specific GIMP replacement content for the advisory-listed CVEs and product relationships.
What To Validate Now
- Inventory. Locate GIMP on RHEL 9.4 Extended Update Support; record the installed NEVRA, repository and entitlement, accountable owner, exposure, dependent services, and maintenance group.
- Establish applicability. Use the product-status relationships in RHSA-2026:80509. Do not infer applicability from the component name, CVE overlap, or CVSS rating alone.
- Remediate. Install gimp 2.99.8-4.el9_4.19 and the matching advisory-listed packages from the supported Red Hat channel for the exact entitled branch.
- Validate. Confirm the installed package, exercise representative GIMP and dependent-service functions, monitor for regressions, and document any exception or rollback.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Prioritize workstations or services that open untrusted images. Test managed plug-ins, file-format workflows, color profiles, exports, and rollback before broad deployment. Preserve pre-change versions, package-manager output, service restart evidence, validation results, and any rollback decision.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
