Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPM files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28901.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-11 | 1 | Disclosure1 |
| 2026-04-19 | 1 | Disclosure1 |
| 2026-04-21 | 1 | Patch1 |
🚨 HIGH: CVE-2026-4154 (CVSS 7.8) - GIMP XPM file parsing integer overflow enables RCE. User interaction required. Patch GIMP immediately. #CVE #PatchNow #ThreatIntel https://t.co/ZT5CUHROAI
Post summary
The tweet alerts that GIMP is vulnerable to CVE-2026-4154, an integer overflow that could lead to remote code execution, and urges users to apply the patch immediately.
CVE-2026-4154 GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installatio… https://www.cve.org/CVERecord?id=CVE-2026-4154
Post summary
The post announces CVE‑2026‑4154, a GIMP integer‑overflow flaw in XPM parsing that permits remote code execution, but provides no PoC, exploit details, or mitigation information.
CVE-2026-4154 Remote Code Execution via Integer Overflow in GIMP XPM File Parsing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4154
Post summary
A brief disclosure of CVE-2026-4154, describing a Remote Code Execution flaw caused by an integer overflow during XPM file parsing in GIMP, with no PoC, exploit, patch, or active exploitation details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gimp | gimp | 3.0.8 | - | - |