CVE-2026-4152

CVE-2026-4152 is a heap-based buffer overflow vulnerability in GIMP's JP2 file parsing functionality that allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient validation of user-supplied data length before copying it to heap memory, enabling code execution within the current process context. Exploitation requires user interaction, such as opening a malicious JP2 file or visiting a compromised webpage. The vulnerability carries a CVSS 3.0 score of 7.8 (HIGH) with a local attack vector, low complexity, and no privilege escalation requirement. It poses significant risk across all impact categories: confidentiality, integrity, and availability. The EPSS score of 0.00034 indicates relatively low probability of exploitation compared to other disclosed vulnerabilities. Currently, CVE-2026-4152 shows no active exploitation in the wild and is not tracked on the Known Exploited Vulnerabilities catalog. Community attention remains limited, with the vulnerability designated as inactive on threat tracking lists. Organizations should prioritize patching based on GIMP deployment scope and user exposure to untrusted JP2 files rather than imminent threat indicators.