{"id":"CVE-2026-4887","state":"PUBLISHED","title":"Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image","description":"A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).","publishedAt":"2026-03-26T12:08:47.354Z","updatedAt":"2026-06-16T21:43:30.878Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 6"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.8.22-1.el7_9.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8100020260512115927.4c9c024f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8040020260520140422.70584597","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8040020260520140422.70584597","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8060020260520140100.6af1eaf0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8060020260520140100.6af1eaf0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8060020260520140100.6af1eaf0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8080020260520102644.0621e4ee","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8080020260520102644.0621e4ee","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-1.el9_7.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-4.el9_8.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-3.el9_0.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_2.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_4.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_6.7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"gimp","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]}],"references":["https://access.redhat.com/errata/RHSA-2026:16484","https://access.redhat.com/errata/RHSA-2026:17533","https://access.redhat.com/errata/RHSA-2026:19362","https://access.redhat.com/errata/RHSA-2026:20552","https://access.redhat.com/errata/RHSA-2026:20553","https://access.redhat.com/errata/RHSA-2026:20554","https://access.redhat.com/errata/RHSA-2026:20691","https://access.redhat.com/errata/RHSA-2026:25899","https://access.redhat.com/errata/RHSA-2026:25901","https://access.redhat.com/errata/RHSA-2026:25907","https://access.redhat.com/errata/RHSA-2026:26168","https://access.redhat.com/security/cve/CVE-2026-4887","https://bugzilla.redhat.com/show_bug.cgi?id=2451669","https://gitlab.gnome.org/GNOME/gimp/-/issues/15960"],"weaknesses":["CWE-193"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4887.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4887","state":"PUBLISHED","datePublished":"2026-03-26T12:08:47.354Z","dateUpdated":"2026-06-16T21:43:30.878Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-03-26T11:33:19.455Z"},"containers":{"cna":{"title":"Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image","descriptions":[{"lang":"en","value":"A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS)."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.8.22-1.el7_9.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8100020260512115927.4c9c024f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8040020260520140422.70584597","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8040020260520140422.70584597","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8060020260520140100.6af1eaf0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8060020260520140100.6af1eaf0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8060020260520140100.6af1eaf0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8080020260520102644.0621e4ee","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"gimp:2.8","defaultStatus":"affected","versions":[{"version":"8080020260520102644.0621e4ee","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-1.el9_7.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:3.0.4-4.el9_8.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-3.el9_0.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_2.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_4.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"gimp","defaultStatus":"affected","versions":[{"version":"2:2.99.8-4.el9_6.7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"gimp","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:16484","name":"RHSA-2026:16484","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17533","name":"RHSA-2026:17533","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19362","name":"RHSA-2026:19362","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20552","name":"RHSA-2026:20552","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20553","name":"RHSA-2026:20553","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20554","name":"RHSA-2026:20554","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20691","name":"RHSA-2026:20691","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25899","name":"RHSA-2026:25899","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25901","name":"RHSA-2026:25901","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25907","name":"RHSA-2026:25907","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26168","name":"RHSA-2026:26168","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4887","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451669","name":"RHBZ#2451669","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/15960"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-193","description":"Off-by-one Error","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-16T21:43:30.878Z"},"datePublic":"2026-03-26T11:35:00.070Z","x_redhatCweChain":"CWE-193: Off-by-one Error","workarounds":[{"lang":"en","value":"Users should avoid opening untrusted PCX image files with GIMP. If GIMP is not required, consider removing the `gimp` package to eliminate this attack vector."}],"timeline":[{"lang":"en","time":"2026-03-26T11:34:22.208Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-26T11:35:00.070Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Meshaal (@unrealmesh) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-26T12:58:38.570446Z","id":"CVE-2026-4887","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-26T12:58:45.569Z"}}]}}}