Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malformed PCX file
  2. Delivery
    Deliver via email or web download
  3. Exploit
    User opens file in GIMP
  4. Execution
    PCX loader triggers off-by-one read
  5. Impact
    Heap memory disclosed and/or process crashes

Vulnerability Assessment

Weakness
CWE
CWE-193
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
Exploitation Conditions

Exploitation requires (1) the victim to have a vulnerable GIMP build installed (RHEL 6/7/8/9 packages per the CPEs, plus Debian builds), (2) the attacker to deliver a specially crafted PCX-format image file, and (3) the victim to actively open that file in GIMP - UI:R in the CVSS vector. The PCX loader must be enabled (it is by default in stock GIMP). Limiting factors: no network-facing service is exposed (AV:L), no privilege escalation occurs (S:U), the impact is bounded to information disclosure of nearby heap bytes and an application crash (no code execution is claimed), and SSVC marks the issue as not automatable, so worm-style mass exploitation is implausible.
Impact

Real-world risk is moderate-to-low despite the 7.1 CVSS base score. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) correctly models GIMP as a local desktop application requiring a user to open a malicious file; impact is bounded to memory disclosure and a process crash (no code execution claimed). CISA's SSVC decision points reinforce this: exploitation=none, automatable=no, technical impact=partial - i.e., not a candidate for mass automated exploitation. EPSS at 0.06% (19th percentile) and absence from CISA KEV are consistent with that view. One notable tension: the description mentions 'remote attacker' while the CVSS uses AV:L - these are not contradictory (the file is delivered remotely but parsed locally), but readers should not interpret AV:L as 'LAN-only'. The C:H rating is somewhat aggressive for a single-byte over-read whose disclosure window is limited to nearby heap bytes; defenders may reasonably treat the realistic confidentiality impact as lower than 'High'.
Exploit ScenarioDerived

An attacker emails or hosts a malicious .pcx file (or embeds one inside an archive or document workflow) and lures a designer, analyst, or helpdesk user into opening it in GIMP. When GIMP's PCX loader parses the crafted header/scanline, the off-by-one read leaks a small slice of adjacent heap memory and/or crashes the editor, costing the user any unsaved work. No public proof-of-concept is referenced in the supplied data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 15, 2026

Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.

Earlier versions of this analysis (2)
v2 Jun 15, 2026 - 03:28 cvss changed CVSS 7.1

Heap buffer over-read in GIMP's PCX image file loader allows a remote attacker to disclose out-of-bounds memory or crash the application when a user opens a maliciously crafted PCX file. The flaw stems from an off-by-one error (CWE-193) in the PCX parser and affects GIMP as shipped on Red Hat Enterprise Linux 6 through 9. EPSS exploitation probability is very low (0.06%, 19th percentile) and there is no public exploit identified at time of analysis, but a vendor patch is available via multiple RHSA errata.

v1 Mar 26, 2026 - 12:30 CVSS 6.1

GIMP's PCX file loader contains a heap buffer over-read vulnerability caused by an off-by-one error (CWE-193) that allows local attackers to trigger out-of-bounds memory disclosure and application crashes by opening specially crafted PCX images. Red Hat Enterprise Linux versions 6 through 9 are affected. The vulnerability requires user interaction to open a malicious file but carries a CVSS score of 6.1 with high availability impact; no public exploit code or active exploitation has been identified at the time of analysis.

RemediationAI

Patch available per vendor advisory: apply the Red Hat errata that cover your RHEL release - RHSA-2026:16484, RHSA-2026:17533, RHSA-2026:19362, RHSA-2026:20552, RHSA-2026:20553, RHSA-2026:20554, RHSA-2026:20691, RHSA-2026:25899, RHSA-2026:25901, and RHSA-2026:25907 (all under https://access.redhat.com/errata/). Debian users should track their distribution's GIMP security update across the eight affected releases. Until packages can be deployed, instruct users not to open PCX files from untrusted sources, and consider removing or renaming GIMP's PCX plug-in (file-pcx) from the plug-ins directory to disable PCX parsing entirely - the trade-off is loss of legitimate PCX support. Opening suspect files inside a sandbox such as Flatpak's confined GIMP, Firejail, or a disposable VM substantially limits the blast radius of any memory disclosure or crash.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GIMP (GNU Image Manipulation Program) is a widely deployed open-source raster image editor that parses many legacy image formats, including PCX (PC Paintbrush). The vulnerability is an off-by-one error (CWE-193) inside the PCX loader's parsing logic, which causes the decoder to read one byte (or row/scanline element) past the end of an allocated heap buffer. Such over-reads typically expose adjacent heap contents (uninitialized data, other image buffers, allocator metadata) and, when the over-read touches an unmapped page, terminate the process. The issue was reported by Red Hat and tracked upstream at gitlab.gnome.org/GNOME/gimp issue 15960, with RHEL 6/7/8/9 enumerated in the CPE data via Red Hat's GIMP package.

Know when Red Hat Enterprise Linux 6 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vuln.today AI 6.1 MEDIUM

Local file parsing in a desktop app (AV:L), needs user to open the file (UI:R); a single-byte heap over-read realistically leaks limited adjacent memory (C:L), no integrity impact, crash gives A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Red Hat 6.1 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jun 15, 2026 - 03:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 15, 2026 - 03:28 vuln.today
v2 - CVSS changed
Severity Changed
Jun 15, 2026 - 03:22 NVD
MEDIUM HIGH
CVSS changed
Jun 15, 2026 - 03:22 NVD
6.1 (MEDIUM) 7.1 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 26, 2026 - 12:08 nvd
MEDIUM 6.1

DescriptionNVD

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP’s PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).

Executive ViewAI

Why It Matters

GIMP's PCX image loader contains a heap buffer over-read vulnerability (CVE-2026-4887, CVSS 7.1) enabling memory disclosure and application crashes when users open malicious image files. With no public exploit identified at time of analysis and patches available, organizations should apply vendor fixes to mitigate this risk. Patch availability enables rapid remediation for affected GIMP deployments.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
Medium
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 6

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-59090 CRITICAL
9.9 Aug 10

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-107651 MEDIUM POC
5.5 Oct 08

A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2019-19906 HIGH POC
7.5
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Debian

gimp
Release Status Fixed Version Urgency
bullseye vulnerable 2.10.22-4+deb11u2 -
bullseye (security) vulnerable 2.10.22-4+deb11u7 -
bookworm vulnerable 2.10.34-1+deb12u5 -
bookworm (security) vulnerable 2.10.34-1+deb12u9 -
trixie, trixie (security) vulnerable 3.0.4-3+deb13u7 -
forky vulnerable 3.2.0~RC3-1 -
sid vulnerable 3.2.0-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4887 ADVISORY https://vuldb.com/?id.353590 REF https://access.redhat.com/errata/RHSA-2026:16484 REF https://access.redhat.com/errata/RHSA-2026:17533 REF https://access.redhat.com/errata/RHSA-2026:19362 REF https://access.redhat.com/errata/RHSA-2026:20552 REF https://access.redhat.com/errata/RHSA-2026:20553 REF https://access.redhat.com/errata/RHSA-2026:20554 REF https://access.redhat.com/errata/RHSA-2026:20691 REF https://access.redhat.com/errata/RHSA-2026:25899 REF https://access.redhat.com/errata/RHSA-2026:25901 REF https://access.redhat.com/errata/RHSA-2026:25907 REF https://access.redhat.com/security/cve/CVE-2026-4887 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451669 REF https://gitlab.gnome.org/GNOME/gimp/-/issues/15960

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy