Skip to main content

GIMP CVE-2026-4887

| EUVDEUVD-2026-16166 HIGH
Off-by-one Error (CWE-193)
2026-03-26 redhat GHSA-wmqx-rmqw-vxp8
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vuln.today AI
6.1 MEDIUM

Local file parsing in a desktop app (AV:L), needs user to open the file (UI:R); a single-byte heap over-read realistically leaks limited adjacent memory (C:L), no integrity impact, crash gives A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Red Hat
6.1 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 15, 2026 - 03:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 15, 2026 - 03:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 15, 2026 - 03:22 vuln.today
cvss_changed
Severity Changed
Jun 15, 2026 - 03:22 NVD
MEDIUM HIGH
CVSS changed
Jun 15, 2026 - 03:22 NVD
6.1 (MEDIUM) 7.1 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 26, 2026 - 12:30 euvd
EUVD-2026-16166
Analysis Generated
Mar 26, 2026 - 12:30 vuln.today
CVE Published
Mar 26, 2026 - 12:08 nvd
MEDIUM 6.1

DescriptionNVD

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP’s PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).

AnalysisAI

Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.

Technical ContextAI

GIMP (GNU Image Manipulation Program) is a widely deployed open-source raster image editor that parses many legacy image formats, including PCX (PC Paintbrush). The vulnerability is an off-by-one error (CWE-193) inside the PCX loader's parsing logic, which causes the decoder to read one byte (or row/scanline element) past the end of an allocated heap buffer. Such over-reads typically expose adjacent heap contents (uninitialized data, other image buffers, allocator metadata) and, when the over-read touches an unmapped page, terminate the process. The issue was reported by Red Hat and tracked upstream at gitlab.gnome.org/GNOME/gimp issue 15960, with RHEL 6/7/8/9 enumerated in the CPE data via Red Hat's GIMP package.

RemediationAI

Patch available per vendor advisory: apply the Red Hat errata that cover your RHEL release - RHSA-2026:16484, RHSA-2026:17533, RHSA-2026:19362, RHSA-2026:20552, RHSA-2026:20553, RHSA-2026:20554, RHSA-2026:20691, RHSA-2026:25899, RHSA-2026:25901, and RHSA-2026:25907 (all under https://access.redhat.com/errata/). Debian users should track their distribution's GIMP security update across the eight affected releases. Until packages can be deployed, instruct users not to open PCX files from untrusted sources, and consider removing or renaming GIMP's PCX plug-in (file-pcx) from the plug-ins directory to disable PCX parsing entirely - the trade-off is loss of legitimate PCX support. Opening suspect files inside a sandbox such as Flatpak's confined GIMP, Firejail, or a disposable VM substantially limits the blast radius of any memory disclosure or crash.

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-58222 HIGH
8.8 Jul 30

Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated

CVE-2026-5260 HIGH
8.2 May 26

Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap

CVE-2026-0966 HIGH
8.2 Mar 26

Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces

CVE-2026-42013 HIGH
8.2 May 26

Here is the multi-source synthesis as a single JSON object: ```json { "product_name": "GnuTLS", "summary": "Certifi

CVE-2026-14476 HIGH
8.0 Jul 07

Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Re

Vendor StatusVendor

Debian

gimp
Release Status Fixed Version Urgency
bullseye vulnerable 2.10.22-4+deb11u2 -
bullseye (security) vulnerable 2.10.22-4+deb11u7 -
bookworm vulnerable 2.10.34-1+deb12u5 -
bookworm (security) vulnerable 2.10.34-1+deb12u9 -
trixie, trixie (security) vulnerable 3.0.4-3+deb13u7 -
forky vulnerable 3.2.0~RC3-1 -
sid vulnerable 3.2.0-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed

Share

CVE-2026-4887 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy