This advisory covers multiple vulnerabilities in GIMP on Red Hat Enterprise Linux 9, including memory disclosure and denial of service via a crafted PCX image (CVE-2026-4887), and remote code execution vulnerabilities via integer overflows in XPM (CVE-2026-4154) and ANI (CVE-2026-4151) file parsing, malicious JP2 file parsing (CVE-2026-4152), specially crafted PSD files (CVE-2026-4150), and PSP file parsing (CVE-2026-4153). These vulnerabilities allow attackers to execute arbitrary code or cause denial of service by processing malicious image files. Red Hat has released an updated GIMP package (3.0.4-1.el9_7.5) for Red Hat Enterprise Linux 9 to fix these issues. The update is rated with an important security impact by Red Hat Product Security. No known exploits in the wild have been reported at this time.

Successful exploitation of these vulnerabilities could lead to arbitrary code execution or denial of service on affected systems running vulnerable versions of GIMP. This could compromise system integrity and availability. The vulnerabilities affect image parsing components, which are commonly used features, increasing the risk if malicious image files are processed.

Red Hat has released an updated GIMP package (version 3.0.4-1.el9_7.5) that addresses all listed vulnerabilities. Users running affected versions of Red Hat Enterprise Linux 9 should apply this update promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor beyond applying the official update.