Integer overflow in Gimp - CVE-2026-4151

Vulnerability identifier: #VU124155

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-4151

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow. A remote attacker can trick a victim to open a specially crafted ANI file, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Gimp
Debian Linux
openEuler
gimp (Debian package)
gimp-debuginfo
gimp-debugsource
gimp-devel
gimp-extension-goat-excercises
gimp-libs
gimp-plugin-aa
gimp-plugin-python3
gimp-vala
gimp

Install updates from vendor's website.

gimp (Debian package) - addressed in versions 2.10.34-1+deb12u10, 3.0.4-3+deb13u8
gimp-debuginfo - update to 3.0.2-13
gimp-debugsource - update to 3.0.2-13
gimp-devel - update to 3.0.2-13
gimp-extension-goat-excercises - update to 3.0.2-13
gimp-libs - update to 3.0.2-13
gimp-plugin-aa - update to 3.0.2-13
gimp-plugin-python3 - update to 3.0.2-13
gimp-vala - update to 3.0.2-13
gimp - update to 3.0.2-13

• https://www.zerodayinitiative.com/advisories/ZDI-26-218/

• Multiple vulnerabilities in GIMP
• openEuler 24.03 LTS SP3 update for gimp
• openEuler 24.03 LTS SP2 update for gimp
• openEuler 24.03 LTS SP1 update for gimp
• openEuler 24.03 LTS update for gimp
• Debian update for gimp