CVE-2026-4887: Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image
A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).
Other sources
This issue is a heap buffer over-read in GIMP’s PCX file loader due to an off‑by‑one error in the bytesperline validation logic. A specially crafted PCX image can cause GIMP to read beyond the bounds of a heap buffer when opened, leading to out‑of‑bounds memory disclosure and possible crash. Exploitation requires user interaction (opening a malicious PCX file)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent users from opening PCX images from untrusted sources. Block or strip PCX attachments at email gateways, web/proxy filters, and file-sharing services; implement user awareness so users do not open unsolicited or untrusted .pcx files.
- Operational
If a user opened a suspicious PCX file with GIMP, investigate the endpoint for crashes or unusual behavior, collect relevant logs and samples, and isolate affected systems for forensic analysis because memory disclosure and application crash (DoS) are possible.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4887?
CVE-2026-4887 has been categorized as a moderate severity vulnerability due to its potential for memory disclosure and denial of service.
How do I fix CVE-2026-4887?
To fix CVE-2026-4887, users should update GIMP to the latest version where the vulnerability has been resolved.
Who is affected by CVE-2026-4887?
Users of GIMP who open specially crafted PCX images are at risk of vulnerability exploitation under CVE-2026-4887.
What type of vulnerability is CVE-2026-4887?
CVE-2026-4887 is a heap buffer over-read vulnerability related to GIMP’s PCX file loader.
Can CVE-2026-4887 lead to remote code execution?
No, CVE-2026-4887 does not directly lead to remote code execution, but it can cause memory disclosure and denial of service.