GIMP
GIMP is a free image editor for retouching photos, drawing and combining pictures. It’s made by The GIMP Team.
Criminals have used its name in fake downloads or scams, so get it only from gimp.org.
What it is
People use GIMP to edit photographs, paint and combine images using layers. It supports many image file formats.
GIMP reads and changes image files. It keeps settings, thumbnails and recent-file details on your Mac. Its screenshot tool can capture a window or the screen.
The team says the official app contains no adverts or trackers. Official Mac downloads come from GIMP’s website. The team does not publish Mac App Store packages or vouch for packages made by others.
Who makes it
The GIMP Team is a community maintaining the free software project started by Spencer Kimball and Peter Mattis in 1995. Its website is gimp.org.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of GIMP. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is org.gimp.gimp-2.10 or org.gimp.gimp-3 or org.gimp.gimp or org.gimp.gimp-3.0 or org.gimp.gimp-2.10:. Download it only from gimp.org, not from an ad or a link someone sends you.
Fakes. In October 2022, Google ads impersonating GIMP’s official website led to lookalike sites distributing Vidar password-stealing malware as a Windows installer.
What it connects to
In normal use, GIMP talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
www.gimp.org | Checks for new releases. |
docs.gimp.org | Loads the online user manual. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Screen Recording | Allows its screenshot tool to capture a window or the screen. |
| Automation | Allows the mail plug-in to communicate with another app. |
| Local Network | The Mac package declares this permission for notifications about package updates. |
Security record
Problems with GIMP or The GIMP Team in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| GIMP 3.2.8 included security fixes for image plug-ins and older filters, including faults involving deliberately altered image-size information. | ↗ | |
| A malicious APNG image could run an attacker’s code when opened (CVE-2026-92183); GIMP fixed it in version 3.2.6. | ↗ | |
| A malicious Photoshop PSD image could crash GIMP or expose some memory contents (CVE-2026-82343); version 3.2.6 included a fix. | ↗ |
References
- About GIMP gimp.org
- 20 Years of GIMP gimp.org
- GIMP team’s Privacy Policy gimp.org
- GIMP Downloads gimp.org
- GIMP Release Notes gimp.org
- GIMP manual: About and update checks docs.gimp.org
- GIMP 3.2.8 Mac packaging script and bundle identifier github.com
- GIMP 3.2.8 Mac permission descriptions github.com
- GIMP update-check source github.com
- Fleet: GIMP Mac catalogue and bundle identifier fleetdm.com
- Does It ARM: older GIMP bundle metadata doesitarm.com
- GIMP identifiers in macOS uninstaller definitions github.com
- GIMP Mac screenshot implementation github.com
- Apple: Protecting app access to user data support.apple.com
- GIMP 3.2.8 Released gimp.org
- GIMP 3.2.6 Released: security fixes gimp.org
- Zero Day Initiative: GIMP APNG code execution vulnerability zerodayinitiative.com
- Red Hat: CVE-2026-82343 access.redhat.com
- Google ad for GIMP.org served info-stealing malware via lookalike site bleepingcomputer.com