gimp-3.2.2

[Xi Ruoyao]

New patch version.

For some reason the currency doesn't report it??

[Douglas R. Reno]

​https://www.gimp.org/news/2026/03/28/gimp-3-2-2-released/ has the release notes for it

Unfortunately though I must report that this comes with security fixes. We've had a lot of those lately :)

No CVEs assigned yet as I suspect it's still too early, but the bug reports upstream can be found at:

• ​https://gitlab.gnome.org/GNOME/gimp/-/issues/16051 (FITS File Parsing: Integer Overflow in Buffer Allocation Leads to Heap Overflow)

• ​https://gitlab.gnome.org/GNOME/gimp/-/issues/16052 (TIM File Parsing: Stack Out-of-Bounds Write in 4BPP Decode Path)

• ​https://gitlab.gnome.org/GNOME/gimp/-/issues/16056 (ICNS File Parsing: Heap Out-of-Bounds Read in icns_slurp() Due to Missing Cursor Bounds Check)

• ​https://gitlab.gnome.org/GNOME/gimp/-/issues/16058 (PVR File Parsing: Stack Overflow via Unchecked VLA Allocation and Twiddle Table Out-of-Bounds Read)

• ​https://gitlab.gnome.org/GNOME/gimp/-/issues/16075 (Stack Buffer overflow - Seattle-Filmworks Image)

• ​https://gitlab.gnome.org/GNOME/gimp/-/issues/16076 (Heap based Buffer overflow - GIF/JIF Image)

These come from ​https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home

[Douglas R. Reno]

Note that I will wait on filing an SA until we have CVEs as those have been requested.

[Bruce Dubbs]

We had gimp set to 'manual' due to upstream problems. Those are fixed now and I've restored the currency so it works again.

[Joe Locash]

Overview of Changes from GIMP 3.2.0 to GIMP 3.2.2
=================================================

Core:

  - We removed support for a separate folder for loading 32-bit binaries
    on 64-bit Windows. This was being used for core plug-ins for the
    TWAIN plug-in only.
  - Various fixes related to the new non-destructive layer types, or to
    non-destructive layer effects.
  - More robust handling of Procreate and SwatchBooker palettes.
  - Fix scaling paths when importing SVG as paths.
  - We now support reading the documentation being installed in the user
    config directory in the `help/` subdirectory.
  - Histogram dialog: the unique color count feature now takes into
    account any selection.

Graphical User Interface:

  - Theme fixes.
  - Various text fixed for better localization.
  - Display the "Tab" shortcut for the "Hide Docks" action, even though
    it is not a real global shortcut (it only works on the canvas).
  - Metadata Rotation import dialog: you can now click the preview for
    Original and Rotated images in the Metadata Rotation Import Dialog,
    and have it open the image rotated as shown in the preview.

Plug-Ins:

  - Tile: carry over the source image's profile to the newly created
    image.
  - Improve support of: FITS, TIM, PAA, ICNS, PVR, SFW, JIF, PSP, PSD

Translations:

  - Serbian Cyrillic now has upstream support in InnoSetup (in their
    "Unofficial" list still, which means it is less verified). Our
    installer now has Serbian Cyrillic localization too.

Build:

  - NM environment variable is now used in priority for the `nm` tool
    used for the build. This check is stored from configure-time
    environment.
  - Windows x86 32-bit pipeline has now been decommissioned from our CI.
    This implies that 32-bit builds won't be available anymore in our
    Windows installer, just as was already the case on the Windows Store.
  - Meson build:
    * New boolean option -Dtwain-unmaintained: this puts our TWAIN
      plug-in behind a disabled-by-default flag, because this plug-in
      only made sense in 32-bit. The next step will be to replace it by
      a WIA plug-in.
    * Option -Dwin32-32bits-dll-folder removed.
  - GIMP can now be built fully without patches on macOS. The in-house
    macOS build is slowly moving to become our main CI for this OS and
    for making the release DMGs.
  - Snap: enable MIDI (Alsa) support.
  - AppImage: enable "Send by email".

Fixed at 9a96a72433. Leaving open for SA.

[Douglas R. Reno]

The CVEs have been assigned finally! Proceeding with a security shortly...

[Douglas R. Reno]

CVEs now include... CVE-2026-4887, CVE-2026-4150, CVE-2026-4151, CVE-2026-4152, CVE-2026-4153, CVE-2026-4154, CVE-2026-40915, CVE-2026-40916, CVE-2026-40917, CVE-2026-40918, CVE-2026-40919, and CVE-2026-6384

[Douglas R. Reno]

SA-13.0-050 issued.