Hi,

The following vulnerability was published for gegl.

CVE-2026-18300[0]:
| GIMP HDR File Parsing Integer Overflow Remote Code Execution
| Vulnerability. This vulnerability allows remote attackers to execute
| arbitrary code on affected installations of GIMP. User interaction
| is required to exploit this vulnerability in that the target must
| visit a malicious page or open a malicious file.  The specific flaw
| exists within the parsing of HDR files. The issue results from the
| lack of proper validation of user-supplied data, which can result in
| an integer overflow before allocating a buffer. An attacker can
| leverage this vulnerability to execute code in the context of the
| current process. Was ZDI-CAN-29289.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-18300
https://www.cve.org/CVERecord?id=CVE-2026-18300
[1] https://www.zerodayinitiative.com/advisories/ZDI-26-453/
[2] https://gitlab.gnome.org/GNOME/gegl/-/commit/d3d262008299341c5b032b354021632ceadb2799

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
gegl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145018@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated gegl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 12 Sep 2026 10:09:27 +0200
Source: gegl
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 1:0.4.72-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Extras Maintainers <pkg-gnome-extras-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 857394 1145018
Changes:
 gegl (1:0.4.72-1) unstable; urgency=high
 .
   * New upstream release
     - SECURITY UPDATE: Fix HDR file parsing integer overflow
       - CVE-2026-18300 (Closes: #1145018)
   * debian/libgegl-0.4-0t64.symbols: Update
   * Remove unused Build-Depends: libavformat-dev
   * Add Build-Depends: libsdl3-dev
   * Add Build-Depends: opencl-headers (Closes: #857394)
   * Use Files-Excluded to enforce use of packaged opencl headers
   * Add patch to fix build with our use of Files-Excluded
Checksums-Sha1:
 2650b9c7c000c7b028b98ed96f70b0ac93f0a0dc 3043 gegl_0.4.72-1.dsc
 ee8f3b1ed4ded9f4628742afef46c266d44ca3fb 6238888 gegl_0.4.72.orig.tar.xz
 158f6112cb22c3d98e812f5e06dcfe861881d9b7 27548 gegl_0.4.72-1.debian.tar.xz
 0c1481f0ddf364ee360dbf87cc2f29712f5d07de 8437 gegl_0.4.72-1_source.buildinfo
Checksums-Sha256:
 75871316ca7ceb1694ceba15e52718753dec2b87b437f67e507f7fd34a83a17f 3043 gegl_0.4.72-1.dsc
 d7e407eec21f682e9939e5a8417587a1162285e46d0cf974f445b14f9a250316 6238888 gegl_0.4.72.orig.tar.xz
 33bf53a2c8754b3d1c406f03f03ea94ff6373e43156377c2342b66d43cc37ef7 27548 gegl_0.4.72-1.debian.tar.xz
 a47e6c91d228a85ad2a32544a8ffa9da1d9b493a15e53e374a7cd74caab30603 8437 gegl_0.4.72-1_source.buildinfo
Files:
 c6edc1faa5062420743f32ed71ae4d7f 3043 devel optional gegl_0.4.72-1.dsc
 2f0ac37f08ea8a2a888e7b2603a448a5 6238888 devel optional gegl_0.4.72.orig.tar.xz
 26b13a96e94429acb51263cda15ed869 27548 devel optional gegl_0.4.72-1.debian.tar.xz
 923f13df25266b152ad1a71cad20bb90 8437 devel optional gegl_0.4.72-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmqlCoQACgkQ5mx3Wuv+
bH2fOBAAo08f7SVVkJ9d80KWaTDKt1OMf4HTIGoLDt8e16oan3VloTMFTEeg0lR8
TH8zhAOgSEN0ncuqw83O/P8v4Tc17MUHQ0yTF966V2G4TtkelsAiyAhw3teBFYo+
NxQaWxXgPg/Bku1SPPjoWXAxCEKSj/EDGghn+aixq2Oih4aDXQyT/Zitle12OiAN
MJuXuFMqUOqB6VqEnipnUU1JkpsX7RbRFVQm1456F07578kF0kE5YEEPFfZtWkLu
FwcSzEVDEFCgolWHvdSO5/V+xMl7pgti2w6StD2CfAB4/flb5K9aKjkDSmXMlaDh
Sxi4bu/mwZUFbVI2tW8VT5GEEfyAmbYOUzOWcNskmrbOxN7lMvrlQySfQugzcQNk
is14ClSdug+4vs+hIC7gs13pV3l0J5UaGti0XJRTAd4m3eS908sec+iVWfM921Sf
PZdMHGV2bDomX3+CKIdLDvYF7pppkrN6UBLe/ev2zs+AyntzjzhjMlqeWubwPmHB
+rJxhZcgGEmvPzrJFDWaivy5OYVRORfjyZdcApQPQAYXxCTt1pg0yqwL/MQHvCGh
tKqHZNE72VLMfCAEieCQv0pJQbiRvg9N974lpXuUhSEG5evcR5hQGYEahk/n+KaQ
SHYxR3CyEyC0GNFM/yD+Z88krVXz6mM2zgyqrsqB0TRRAnAaw7Y=
=nfpq
-----END PGP SIGNATURE-----