This advisory covers multiple vulnerabilities in GIMP 2.8 on Red Hat Enterprise Linux 8.4, including CVE-2026-4887 (memory disclosure and denial of service via PCX image), CVE-2026-4154 (remote code execution via XPM file parsing integer overflow), CVE-2026-4150 (arbitrary code execution via specially crafted PSD file), and CVE-2026-4153 (remote code execution via PSP file parsing). These vulnerabilities allow attackers to cause memory disclosure, denial of service, or execute arbitrary code by crafting malicious image files. Red Hat has issued an important security update (RHSA-2026:20552) addressing these issues for affected packages in the GIMP 2.8 module on Red Hat Enterprise Linux 8.4 AUS and EUS extensions. The advisory references fixes for each CVE and provides updated packages for remediation.

Successful exploitation of these vulnerabilities can lead to memory disclosure, denial of service, or arbitrary code execution on affected systems running vulnerable versions of GIMP 2.8. This could allow attackers to compromise system confidentiality, availability, or integrity depending on the vulnerability exploited. The impact is significant given the remote code execution potential via crafted image files.

Red Hat has released an important security update (RHSA-2026:20552) for GIMP 2.8 on Red Hat Enterprise Linux 8.4 AUS and EUS extensions that addresses these vulnerabilities. Users should apply the update as detailed in the Red Hat advisory and article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated beyond applying the official update.