CVE-2026-4887: 
NixOS vulnerability analysis and mitigation

CVE-2026-4887 is a heap buffer over-read vulnerability in GIMP's PCX file loader caused by an off-by-one error in the bytesperline validation logic. A remote attacker can exploit this by convincing a user to open a specially crafted PCX image, leading to out-of-bounds memory disclosure and a possible application crash (Denial of Service). Affected versions include all GIMP releases before 3.2.0, as well as pre-release candidates 3.2.0-rc1, 3.2.0-rc2, and 3.2.0-rc3. The vulnerability was disclosed on March 26, 2026, and has a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-193) in GIMP's PCX file loader, specifically in the bytesperline validation logic, which results in a heap buffer over-read (CWE-125). When GIMP processes a maliciously crafted PCX image, the loader reads one byte beyond the allocated heap buffer boundary, potentially exposing adjacent memory contents. Exploitation requires local access in the sense that the attack vector is the user's workstation (AV:L), but the attacker can deliver the malicious file remotely (e.g., via email or download) and relies on user interaction — opening the file — to trigger the flaw. The issue is tracked in the GNOME GIMP issue tracker (GNOME GitLab, Red Hat Bugzilla).

Successful exploitation results in out-of-bounds memory disclosure (high confidentiality impact) and a potential application crash causing Denial of Service (high availability impact); integrity is not affected. The scope is limited to the GIMP process running under the victim user's account, with no privilege escalation or lateral movement potential inherent to this vulnerability. Sensitive data present in GIMP's heap memory — such as image data or other in-memory content — could be exposed to an attacker who can observe the crash output or leverage the read primitive in a more complex exploit chain (Red Hat CVE, Red Hat Bugzilla).

No weaponized exploit code or in-the-wild exploitation has been confirmed for CVE-2026-4887. The GNOME GIMP issue tracker entry is referenced as a potential exploit source, but Feedly's analysis found no actual exploit code or reproduction steps in that report. The EPSS score is approximately 0.06%, indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, GNOME GitLab).

1. Craft malicious PCX file: Create a specially crafted PCX image with a manipulated bytesperline header field that triggers the off-by-one error in GIMP's PCX loader, causing the loader to calculate an incorrect buffer size and read one byte beyond the allocated heap region.
2. Deliver the file: Distribute the malicious PCX file to the target user via email attachment, file-sharing link, or by hosting it on a website and using social engineering to prompt the user to download it.
3. Trigger exploitation: Convince the target user to open the malicious PCX file in GIMP (e.g., by disguising it with a benign filename or icon). GIMP will attempt to parse the file using its PCX loader.
4. Achieve impact: Upon opening, GIMP reads beyond the heap buffer boundary, disclosing adjacent heap memory contents and/or crashing the application. An attacker observing crash dumps or leveraging additional primitives could potentially extract sensitive in-memory data (Red Hat Bugzilla, GNOME GitLab).

• File System: Presence of unexpected or suspicious .pcx files in user download directories, email attachments, or temporary folders that cause GIMP to crash upon opening.
• Logs: Application crash logs or core dumps generated by the GIMP process (e.g., in /var/crash/, ~/.local/share/gnome-abrt/, or system journal entries referencing GIMP segmentation faults or heap errors).
• Process: GIMP process terminating abnormally (SIGSEGV or SIGABRT) shortly after opening a PCX file, observable via system logs (journalctl, /var/log/syslog) or process monitoring tools.

Red Hat has released patched GIMP packages addressing CVE-2026-4887 across multiple RHEL versions:

• RHEL 9: gimp-3.0.4-1.el9_7.5 via RHSA-2026:16484 (May 12, 2026) and gimp-3.0.4-4.el9_8.4 via RHSA-2026:19362 (May 19, 2026)
• RHEL 8: gimp-2.8.22-26.module+el8.10.0+24277+6acc3952.6 via RHSA-2026:17533 (May 14, 2026)
• Additional RHEL 8.x point-release updates via RHSA-2026:20552, RHSA-2026:20553, RHSA-2026:20554, and RHSA-2026:20691

Upstream GIMP 3.2.0 (stable release) is not affected. Users should update to the patched packages provided by their distribution. As a workaround, avoid opening PCX image files from untrusted sources until the patch is applied (Red Hat Bugzilla, RHSA-2026:16484).