GIMP CVE-2026-119528

Exploitation requires a user to open an attacker-crafted PSD file in GIMP; the vulnerable code path is the PSD plug-in's image-resource header loader, which is part of standard PSD import and needs no special configuration to be reachable. Concrete limiting factors: the attacker has no network or automatable vector (AV:L), success depends on user interaction (UI:R - the victim must open the file), and any resulting code execution runs in the local context and privileges of the user running GIMP rather than as root or a service account. This is not remote unauthenticated exploitation.

The CVSS 3.1 score of 7.8 (HIGH) is driven entirely by impact (C:H/I:H/A:H), not by ease of exploitation. The vector qualifies this as a local, user-interaction-dependent flaw: AV:L and UI:R mean an attacker cannot reach it over the network or trigger it automatically - a victim must actively open a crafted PSD file in GIMP. There is no EPSS score, no CISA KEV listing, and no public exploit or PoC reference in the supplied data, so this is 'no public exploit identified at time of analysis' rather than a confirmed or imminently weaponized threat. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-actively-exploited memory-safety bug. The main signals are coherent rather than conflicting: a high-impact local code-execution bug whose real-world exploitation is gated by social engineering (getting a user to open a malicious image). One gap to note explicitly: EPSS is absent, so probabilistic exploitation likelihood cannot be weighed, and no fixed version is stated in the available references. Net: a genuine high-impact issue worth patching on a normal priority cycle, but not a drop-everything emergency given the local vector, required user interaction, and absence of exploitation evidence.

An attacker crafts a malicious PSD file whose image-resource header contains an oversized converted resource name and delivers it to a victim via email, a download, or a shared drive. When the victim opens the file in GIMP, the PSD plug-in copies the name into an undersized fixed stack buffer, overflowing it and causing a crash or potentially arbitrary code execution in the context of the user running GIMP. No public exploit code is identified in the available data.