Skip to content
Fencer Vulns
medium 6.1

CVE-2026-4887 json

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

published 2026-03-26 7 mo ago modified 2026-11-05 3 d ago also EUVD-2026-16166

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 2:2.8.22-1.el7_9.6
  • Red Hat Red Hat Enterprise Linux 8 8100020260512115927.4c9c024f
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260520140422.70584597
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260520140422.70584597
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260520140100.6af1eaf0
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020260520140100.6af1eaf0
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020260520140100.6af1eaf0
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260520102644.0621e4ee
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260520102644.0621e4ee
  • Red Hat Red Hat Enterprise Linux 9 2:3.0.4-1.el9_7.5, 2:3.0.4-4.el9_8.4
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 2:2.99.8-3.el9_0.6
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2:2.99.8-4.el9_2.6
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2:2.99.8-4.el9_4.6
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 2:2.99.8-4.el9_6.7
  • gimp Debian 14 3.2.0-1

debian advisories DEBIAN-CVE-2026-4887

  • gimp RHEL 9 2:3.0.4-4.el9_8.4
  • gimp-libs RHEL 9 2:3.0.4-4.el9_8.4
  • gimp RHEL 8 2:2.8.22-26.module+el8.10.0+24277+6acc3952.6
  • pygtk2 RHEL 8 2.24.0-25.module+el8.9.0+21228+8e80d31d
  • gimp-libs RHEL 8 2:2.8.22-26.module+el8.10.0+24277+6acc3952.6
  • pygobject2 RHEL 8 2.28.7-5.module+el8.10.0+22676+becd68d6
  • python2-cairo RHEL 8 1.16.3-7.module+el8.10.0+22676+becd68d6
  • pygtk2-codegen RHEL 8 2.24.0-25.module+el8.9.0+21228+8e80d31d

red hat advisories RHSA-2026:26168RHSA-2026:25907RHSA-2026:25901RHSA-2026:25899RHSA-2026:20691RHSA-2026:20554

  • gimp SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7 2.10.30-150400.3.53.1

suse advisories SUSE-SU-2026:2756-1

  • gimp AlmaLinux 9 2:3.0.4-4.el9_8.4
  • gimp-libs AlmaLinux 9 2:3.0.4-4.el9_8.4
  • gimp AlmaLinux 8 2:2.8.22-26.module_el8.10.0+4175+c208a0bf.6
  • pygtk2 AlmaLinux 8 2.24.0-25.module_el8.9.0+3725+d1441900
  • gimp-libs AlmaLinux 8 2:2.8.22-26.module_el8.10.0+4175+c208a0bf.6
  • pygobject2 AlmaLinux 8 2.28.7-5.module_el8.10.0+4175+c208a0bf
  • pygobject2 AlmaLinux 8 2.28.7-5.module_el8.10.0+3952+571e801c
  • python2-cairo AlmaLinux 8 1.16.3-7.module_el8.10.0+3952+571e801c

almalinux advisories ALSA-2026:19362ALSA-2026:17533ALSA-2026:16484

  • gimp Rocky Linux 8 2:2.8.22-26.module+el8.10.0+40075+a21479b4.4
  • gimp Rocky Linux 8 2:2.8.22-26.module+el8.10.0+40134+eab491b1.5
  • gimp Rocky Linux 8 2:2.8.22-26.module+el8.10.0+1927+52edb5a0
  • gimp Rocky Linux 8 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
  • gimp Rocky Linux 8 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
  • pygtk2 Rocky Linux 8 2.24.0-25.module+el8.9.0+1723+9bc93544
  • pygobject2 Rocky Linux 8 2.28.7-5.module+el8.10.0+1927+52edb5a0
  • python2-pycairo Rocky Linux 8 1.16.3-7.module+el8.10.0+1927+52edb5a0

rocky linux advisories RLSA-2026:17533RLSA-2026:16484

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4887 updated cvss 6.1

gimp: GIMP:Memory disclosure and denial of service via specially crafted PCX image

  • Red Hat Enterprise Linux 6 gimp, gimp-libs, gimp-devel-tools, gimp-help-browser
    affected: workaround, no fix planned “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.”
  • Red Hat Enterprise Linux AppStream (v. 8) pygtk2 2.24.0-25.module+el8.9.0+21228+8e80d31d, gimp 2.8.22-26.module+el8.10.0+24277+6acc3952.6, pygobject2 2.28.7-5.module+el8.10.0+22676+becd68d6, gimp-libs 2.8.22-26.module+el8.10.0+24277+6acc3952.6, python2-cairo 1.16.3-7.module+el8.10.0+22676+becd68d6, pygtk2-codegen 2.24.0-25.module+el8.9.0+21228+8e80d31d, +3 more
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:17533
  • Red Hat Enterprise Linux AppStream (v. 9) gimp 3.0.4-1.el9_7.5, gimp 3.0.4-4.el9_8.4, gimp-libs 3.0.4-1.el9_7.5, gimp-libs 3.0.4-4.el9_8.4
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:16484
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-16.module+el8.4.0+24320+2aeffe15.6, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-16.module+el8.4.0+24320+2aeffe15.6, +3 more
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:20552
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-18.module+el8.6.0+24319+86704323.6, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-18.module+el8.6.0+24319+86704323.6, +3 more Red Hat Enterprise Linux AppStream E4S (v.8.6) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-18.module+el8.6.0+24319+86704323.6, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-18.module+el8.6.0+24319+86704323.6, +3 more
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:20553
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-26.module+el8.8.0+24316+5c5e4d76.7, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-26.module+el8.8.0+24316+5c5e4d76.7, +3 more
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:20554
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) gimp 2.99.8-3.el9_0.6, gimp-libs 2.99.8-3.el9_0.6
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:20691
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) gimp 2.99.8-4.el9_2.6, gimp-libs 2.99.8-4.el9_2.6
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:25899
show 6 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) gimp 2.99.8-4.el9_4.6, gimp-libs 2.99.8-4.el9_4.6
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:25907
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) gimp 2.99.8-4.el9_6.7, gimp-libs 2.99.8-4.el9_6.7
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:25901
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-16.module+el8.4.0+24320+2aeffe15.6, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-16.module+el8.4.0+24320+2aeffe15.6, +3 more
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:20552
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-18.module+el8.6.0+24319+86704323.6, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-18.module+el8.6.0+24319+86704323.6, +3 more
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:20553
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-26.module+el8.8.0+24316+5c5e4d76.7, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-26.module+el8.8.0+24316+5c5e4d76.7, +3 more
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:20554
  • Red Hat Enterprise Linux Server (v. 7 ELS) gimp 2.8.22-1.el7_9.6, gimp-libs 2.8.22-1.el7_9.6 Red Hat Enterprise Linux Server Optional (v. 7 ELS) gimp 2.8.22-1.el7_9.6, gimp-libs 2.8.22-1.el7_9.6, gimp-devel-tools 2.8.22-1.el7_9.6
    fixed: vendor fix “Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector.” RHSA-2026:26168

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/gimp/-/issues/15960 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.