# CVE-2026-4151: GIMP ANI file parsing integer overflow

Source: https://junglewise.ai/threats/cve-2026-4151-gimp-ani-file-parsing-integer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-11. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-4151 · Severity: high · CVSS 7.8 · Published 2026-04-11

GIMP is a popular open-source image editing application. A vulnerability in how it processes animated cursor (ANI) files could allow an attacker to take control of a user's computer if the user is tricked into opening a malicious file or visiting a compromised website. This could lead to the theft of sensitive data or the installation of malware.

Technologies: [Gimp](https://junglewise.ai/threats/technologies/gimp), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Gimp](https://junglewise.ai/threats/vendors/gimp), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-4151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4151 being exploited in the wild.

**How severe is CVE-2026-4151?** High severity, with a CVSS score of 7.8, published 11 April 2026.

**Which products and versions are affected?** Gimp 3.0.8; Red Hat Enterprise Linux AppStream gimp-3.0.4-1.el9_7.5.

**Is there a fix for CVE-2026-4151?** A patch was published on 2026-05-12: Red Hat release of RHSA-2026:16484 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4151 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-4151?** Check whether you run Gimp, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in GIMP's ANI file parsing component due to insufficient validation of user-supplied data. The flaw occurs when the application calculates the size for a buffer allocation, leading to a heap-based buffer overflow. An attacker can exploit this by providing a specially crafted ANI file, which requires the victim to manually open the file or interact with a malicious webpage. Successful exploitation allows for arbitrary code execution within the context of the current process. Patches have been released by GIMP and Red Hat (RHSA-2026:16484, RHSA-2026:19362).

## Affected products

- GIMP GIMP 3.0.8
- Red Hat Red Hat Enterprise Linux AppStream (v. 9) gimp-3.0.4-1.el9_7.5
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 8

## Timeline

- 2026-03-05: disclosed: Vulnerability reported to vendor
- 2026-03-19: advisory: Coordinated public release of ZDI advisory
- 2026-04-11: advisory: NVD publication date
- 2026-05-12: patched: Red Hat release of RHSA-2026:16484

## References

- [https://gitlab.gnome.org/GNOME/gimp/-/commit/09e5459de913172fc51da3bd6b6adc533acd368e](https://gitlab.gnome.org/GNOME/gimp/-/commit/09e5459de913172fc51da3bd6b6adc533acd368e)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-218/](https://www.zerodayinitiative.com/advisories/ZDI-26-218/)
- [https://access.redhat.com/errata/RHSA-2026:16484](https://access.redhat.com/errata/RHSA-2026:16484)
- [https://access.redhat.com/errata/RHSA-2026:19362](https://access.redhat.com/errata/RHSA-2026:19362)
- [https://access.redhat.com/security/cve/CVE-2026-4151](https://access.redhat.com/security/cve/CVE-2026-4151)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2457532](https://bugzilla.redhat.com/show_bug.cgi?id=2457532)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4151.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4151.json)

## Related threats

- [GIMP use-after-free in XCF path loader](https://junglewise.ai/threats/cve-2026-112261-a-flaw-was-found-in-gimp-opening-a-crafted-xcf-that-selects-a)
- [GIMP use-after-free in XCF loader](https://junglewise.ai/threats/cve-2026-112258-a-flaw-was-found-in-gimp-the-xcf-loader-can-leave-a-dangling)
- [GIMP integer overflow in file-pvr plug-in](https://junglewise.ai/threats/cve-2026-62439-a-flaw-was-found-in-gimp-an-integer-overflow-occurs-in-the-file)
- [GIMP heap buffer overflow in raw data export](https://junglewise.ai/threats/cve-2026-106066-a-heap-based-buffer-overflow-was-found-in-gimp-s-raw-data-export)
- [GIMP heap buffer overflow in GIF export](https://junglewise.ai/threats/cve-2026-106064-a-heap-based-buffer-overflow-was-found-in-gimp-s-gif-export-plug)