Junglewise Threat Intelligence

CVE-2026-4154: GIMP XPM file parsing integer overflow

CVE-2026-4154 · Severity: high · CVSS 7.8 · Published 2026-04-11

Technologies: Gimp, Red Hat Enterprise Linux. Vendors: Gimp, Red Hat.

Executive brief

GIMP is a popular open-source image editing tool used for graphic design and photo manipulation. A vulnerability in how it processes XPM image files could allow an attacker to take control of a user's computer if the user is tricked into opening a specially crafted malicious file. This could lead to the theft of sensitive data, unauthorized access to the system, or the installation of malware.

Technical details

An integer overflow vulnerability exists in GIMP's XPM file parsing logic due to insufficient validation of user-supplied data. When processing a specially crafted XPM file, the application may perform an incorrect integer calculation before allocating a memory buffer, leading to a heap-based buffer overflow. An attacker can exploit this by convincing a user to open a malicious XPM image or visit a website that triggers the file's processing. Successful exploitation allows for arbitrary code execution within the context of the GIMP process. Patches have been released by the GNOME project and downstream vendors like Red Hat to address the flaw by improving input validation during file parsing.

Affected products

  • GIMP GIMP 2.8, 3.0.4
  • Red Hat Enterprise Linux 7, 8, 9

Timeline

  • 2026-03-05: disclosed: Vulnerability reported to vendor
  • 2026-03-19: advisory: Coordinated public release by Zero Day Initiative
  • 2026-04-11: advisory: NVD publication date
  • 2026-05-12: patched: Red Hat released security updates for RHEL 9

References

Related threats