This vulnerability involves a heap buffer over-read in GIMP's PCX file loader due to an off-by-one error. When a user opens a maliciously crafted PCX image, the flaw can lead to out-of-bounds memory disclosure and application crashes (denial of service). The issue affects GIMP versions shipped with Red Hat Enterprise Linux 7 Extended Lifecycle Support and later RHEL 8 and 9 releases. Red Hat has released security updates that fix this vulnerability as part of broader GIMP security patches. The CVSS v3.1 base score is 6.1 (medium severity), reflecting local attack vector with low complexity, no privileges required, user interaction needed, and impact on confidentiality (low) and availability (high).

Successful exploitation can disclose memory contents beyond intended boundaries and cause application crashes, resulting in denial of service. There is no indication of remote code execution or privilege escalation from this specific vulnerability. The attack requires local access and user interaction (opening a crafted PCX image).

Red Hat has released official security updates for GIMP that address CVE-2026-4887. Applying these updates will remediate the vulnerability. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to update affected GIMP packages on their systems. No additional mitigation steps are indicated by the vendor advisory.