CVE-2026-4887Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Enterprise Linux 7 Extended Lifecycle Support and 7 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).
- CVSS
- 6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- Weakness (CWE)
- CWE-193
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Modified
- Record last updated
- Jun 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
from 2:2.8.22-1.el7_9.6 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux | from 8100020260512115927.4c9c024f not affected | CNA record |
from 8040020260520140422.70584597 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support redhat:rhel_eus_long_life | from 8040020260520140422.70584597 not affected | CNA record |
from 8060020260520140100.6af1eaf0 not affected | CNA record | |
from 8060020260520140100.6af1eaf0 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 2:2.99.8-4.el9_6.7 not affected | CNA record |
gimp gimp gimp:gimp | before 3.2.0; 3.2.0; 3.2.0; 3.2.0 | NVD |
References
- https://access.redhat.com/errata/RHSA-2026:16484vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:17533vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:19362vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:20552vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:20553vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:20554vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:20691vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:25899vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:25901vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:25907vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:26168vendor-advisory, x-refsource-redhat
- https://access.redhat.com/security/cve/CVE-2026-4887vdb-entry, x-refsource-redhat, mitigation, vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2451669issue-tracking, x-refsource-redhat, vendor-advisory
- https://gitlab.gnome.org/GNOME/gimp/-/issues/15960exploit, issue-tracking
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.