GIMP CVE-2026-108093

Exploitation requires the victim to open a specially crafted XCF (GIMP native) file in which an image-simulation-intent or image-simulation-bpc parasite is present but has zero-size data. The attacker needs no authentication or privileges on the target, but exploitation is gated by mandatory user interaction (the victim must manually open the malicious file) and local access to the application - there is no remote or network-facing trigger. Limiting factors: impact is confined to a crash of the GIMP process (denial of service only, no code execution or data exposure), and the attacker must socially engineer the victim into opening attacker-supplied content.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 5.5 (MEDIUM) and is internally consistent with the description: exploitation requires local access (AV:L) and user interaction (UI:R) - specifically, a victim must open a maliciously crafted XCF file - and the only impact is availability (A:H) via an application crash, with no confidentiality or integrity impact (C:N/I:N). The flaw is a NULL pointer dereference (CWE-476) causing a client-side denial of service, not code execution. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input; absence of these is expected for a newly-published, crash-only desktop-application bug. Exploitation status: no public exploit identified at time of analysis. The signals are not conflicting - they consistently point to a low-real-risk, locally-triggered DoS requiring social engineering to deliver the file, rather than a remotely automatable threat warranting emergency patching.

An attacker crafts a malicious XCF file containing a zero-size image-simulation-intent or image-simulation-bpc parasite and delivers it to a victim (e.g., via email or a download). When the victim opens the file in GIMP, the XCF loader dereferences the absent parasite data, triggering a NULL pointer dereference that crashes the application. No public POC is identified; the local vector and required user interaction limit this to opportunistic social-engineering delivery with only a denial-of-service outcome.