GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPM files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28901.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required     to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The     specific flaw exists within the parsing of XPM files. The issue results from the lack of proper validation     of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can     leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28901.
    (CVE-2026-4154)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1193-1 advisory.

    - CVE-2026-4150: PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1259979).
    - CVE-2026-4153: PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (bsc#1259984).
    - CVE-2026-4154: XPM File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1259986).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20428-1 advisory.

    Changes in gimp:

    - CVE-2026-4150: Fixed PSD file parsing integer overflow vulnerability (bsc#1259979)     = CVE-2026-4151: Fixed ANI file parsing integer overflow vulnerability (bsc#1259983)
    - CVE-2026-4153: Fixed PSP file parsing heap-based buffer overflow vulnerability (bsc#1259984)
    - CVE-2026-4154: Fixed XPM file parsing integer overflow vulnerability (bsc#1259986)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of GIMP installed on the remote macOS host is prior to 3.2.0. It is, therefore, affected by multiple vulnerabilities:

  - An integer overflow condition exists in PSD file parsing due to improper validation of user-supplied data. An     unauthenticated, local attacker can exploit this, via a specially crafted PSD file, to execute arbitrary code.
    (CVE-2026-4150)

  - An integer overflow condition exists in ANI file parsing due to improper validation of user-supplied data. An     unauthenticated, local attacker can exploit this, via a specially crafted ANI file, to execute arbitrary code.
    (CVE-2026-4151)

  - A heap-based buffer overflow condition exists in JP2 file parsing due to improper validation of the length of     user-supplied data. An unauthenticated, local attacker can exploit this, via a specially crafted JP2 file, to     execute arbitrary code. (CVE-2026-4152)

  - A heap-based buffer overflow condition exists in PSP file parsing due to improper validation of the length of     user-supplied data. An unauthenticated, local attacker can exploit this, via a specially crafted PSP file, to     execute arbitrary code. (CVE-2026-4153)

  - An integer overflow condition exists in XPM file parsing due to improper validation of user-supplied data. An     unauthenticated, local attacker can exploit this, via a specially crafted XPM file, to execute arbitrary code.
    (CVE-2026-4154)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
306022	Linux Distros Unpatched Vulnerability : CVE-2026-4154	Nessus	Misc.	high
305281	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gimp (SUSE-SU-2026:1193-1)	Nessus	SuSE Local Security Checks	high
304231	openSUSE 16 Security Update : gimp (openSUSE-SU-2026:20428-1)	Nessus	SuSE Local Security Checks	high
303973	GIMP < 3.2.0 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2026-4154

high

Tenable Plugins

high

high

high

high