CVE-2026-4151

CVE-2026-4151 is an integer overflow vulnerability in GIMP's ANI (Animated Cursor) file parsing functionality that enables remote code execution. The flaw stems from insufficient validation of user-supplied data when processing ANI files, allowing an integer overflow during buffer allocation. Exploitation requires user interaction, such as opening a malicious ANI file or visiting a compromised webpage. The vulnerability carries a CVSS 3.0 score of 7.8 (HIGH) with a local attack vector, low complexity, and no privilege requirements. It delivers high impact across confidentiality, integrity, and availability, allowing attackers to execute arbitrary code with the privileges of the affected GIMP process. The EPSS score of 0.000370 indicates low probability of exploitation relative to other CVEs. There is currently no evidence of active exploitation, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and does not appear on the Hot List. No publicly available exploit code has been documented, and community attention remains minimal based on available threat intelligence.