GIMP CVE-2026-106061

Requires a victim to open, or have a file manager auto-generate a thumbnail for, an attacker-supplied crafted X cursor (XMC) file whose width and height are chosen to overflow 32-bit signed multiplication in GIMP's XMC thumbnail loader. Exploitation is strictly local (AV:L) and depends on user interaction (UI:R) - the attacker cannot trigger it remotely or without the victim handling the malicious file. Impact is limited to crashing GIMP or corrupting its process memory (availability only); there is no authentication bypass and no network-facing exposure, which substantially limits realistic risk.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, user-interaction-dependent flaw whose only confirmed impact is availability (A:H) - i.e. a crash - with explicitly no confidentiality (C:N) or integrity (I:N) impact. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no evidence of exploitation probability or active abuse; exploitation status is best characterized as no public exploit identified at time of analysis. The signals are internally consistent except for one tension: the metadata carries an 'Information Disclosure' tag and the description notes an out-of-bounds heap READ (CWE-125), which could in theory leak adjacent heap memory, yet the authoritative CVSS vector sets C:N - so the practical outcome is a crash/memory corruption rather than confirmed data exfiltration. Treat the 'Information Disclosure' framing as unverified against the scored vector. Overall this is a 'high-attention-looking CWE, low-real-risk' case: a classic integer-overflow→OOB-read in a desktop image tool's thumbnail path, requiring a victim to handle an attacker-crafted file locally, with no privilege escalation and no network vector.

An attacker crafts a malicious X cursor (XMC) file with dimensions chosen so that width * height overflows 32-bit signed arithmetic, then delivers it to a victim (e.g., via download, email attachment, or a shared folder). When the victim opens the file in GIMP or a file manager auto-generates a thumbnail, GIMP under-allocates the pixel buffer and performs an out-of-bounds heap read, crashing the application or corrupting process memory. No public exploit code was identified in the provided data, and exploitation yields only a crash/denial of service rather than code execution or data theft.