This Red Hat security advisory addresses four vulnerabilities in GIMP 2.8 related to image file parsing: CVE-2026-4887 (memory disclosure and denial of service via PCX images), CVE-2026-4154 (remote code execution via XPM file parsing integer overflow), CVE-2026-4150 (arbitrary code execution via specially crafted PSD files), and CVE-2026-4153 (remote code execution via PSP file parsing). These vulnerabilities arise from improper handling of image file formats, potentially allowing attackers to execute arbitrary code or cause denial of service. The advisory covers Red Hat Enterprise Linux 8 and associated packages. Red Hat has released updated packages to address these issues.

Successful exploitation of these vulnerabilities could allow an attacker to disclose memory contents, cause denial of service, or execute arbitrary code on affected systems running vulnerable versions of GIMP. This could lead to unauthorized control or disruption of the system. The advisory rates the overall impact as important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated GIMP 2.8 packages for Red Hat Enterprise Linux 8 that fix these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:17533 and the referenced article https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires applying the vendor-provided patches. Patch status is confirmed as available via the vendor advisory.