CVE-2026-4153

CVE-2026-4153 is a heap-based buffer overflow vulnerability in GIMP's PSP (Paint Shop Pro) file parser that enables remote code execution when a user opens a malicious PSP file. The vulnerability stems from insufficient validation of user-supplied data length before copying it to a heap buffer, allowing arbitrary code execution in the context of the affected process. This vulnerability was previously tracked as ZDI-CAN-28874. The vulnerability carries a CVSS 3.0 score of 7.8 (HIGH) with a local attack vector, low complexity, and no privilege requirements. User interaction is necessary, requiring the victim to open a malicious file or visit a malicious page. Successful exploitation grants attackers high impact across confidentiality, integrity, and availability of the affected system. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog and shows no indicators of active exploitation in the wild. The EPSS score of 0.0006 indicates a very low predicted probability of exploitation, and the vulnerability remains inactive on exploit tracking lists. Community attention appears limited at this time.