GIMP CVE-2026-18302

Exploitation requires the target user to actively open a crafted TIFF file using GIMP 3.2.2 - the explicitly confirmed affected version per EUVD-2026-63451. The CVSS vector confirms PR:N (no attacker privileges required) and UI:R (victim must perform the file-open action, either directly in GIMP or via an OS file-association triggered by a download). The vulnerability is in the TIF file parsing code path specifically, meaning only TIFF-format files trigger the flaw; other image formats are not implicated. Exploitation is bounded to the current user process (S:U), so no privilege escalation or cross-system scope change occurs. Key limiting factors: the victim must be running the affected GIMP version, must receive and open the malicious TIFF file, and the attacker cannot exploit this vulnerability via network-only access absent that interaction.

CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a local, user-interaction-dependent attack with no attacker privileges required and full impact across all three security pillars. The local attack vector (AV:L) is the primary limiting factor - the attacker cannot exploit this vulnerability over the network without the victim first opening the malicious file. Attack complexity is low once the file is opened, meaning exploitation is straightforward for an attacker who can engineer that interaction. EPSS data is absent from the provided intelligence, limiting probabilistic forecasting; KEV status is not listed, and no public exploit code has been identified, so exploitation risk currently depends entirely on targeted social engineering delivery rather than automated scanning. Despite the absence of active exploitation signals, the ZDI origin and high C:H/I:H/A:H triad make this a genuine remediation priority for any organization where GIMP is deployed on endpoints handling externally sourced image files - even a mid-sized organization's creative or technical team represents a realistic delivery surface. No conflicting signals exist between the CVSS vector and the description; both consistently describe a file-open-triggered local heap overflow.

An attacker crafts a malicious TIFF image embedding an oversized data field targeting GIMP's heap-based TIF parser buffer. The file is delivered via a phishing email, a compromised file-sharing link, or a webpage that prompts the victim to download and open it - inducing the required user interaction. When the victim opens the file in GIMP 3.2.2, the parser copies the oversized attacker-controlled data into the undersized heap buffer, corrupting adjacent heap memory and enabling the attacker to redirect code execution to arbitrary shellcode running with the privileges of the current user. No public exploit code has been identified at time of analysis.