GIMP CVE-2026-18305

The sole exploitation prerequisite is that the target user opens a crafted TIF file in GIMP 3.2.2 - no authentication, special privileges, or non-default configuration is required. User interaction (UI:R per CVSS) is mandatory: the victim must actively open or preview the malicious file within GIMP. This UI:R barrier limits broad automated exploitation in standard desktop scenarios. However, environments using GIMP or its underlying libtiff integration in unattended batch image-processing pipelines (e.g., server-side thumbnail generation, CI/CD asset pipelines) could be exploited without user interaction if they accept attacker-supplied TIFF inputs, effectively nullifying the UI:R constraint. Exploitation is bounded to the current user's process context (S:U); no privilege escalation beyond the GIMP process is expected.

The NVD CVSS 3.0 base score is 7.8 (High), with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The AV:L designation warrants clarification: ZDI routinely assigns AV:L to file-format vulnerabilities because exploitation occurs during local file parsing, even though the attacker can deliver the malicious file remotely via email or a web download - the 'remote attackers' language in the description reflects delivery, not the CVSS attack vector. No EPSS score was provided in the source data; the absence of a KEV listing and public exploit code reduces operational urgency relative to a patch-prioritization standpoint. The required user interaction (UI:R) is a meaningful real-world barrier, but one that is routinely overcome through phishing and social engineering. Scope is unchanged (S:U), meaning exploitation does not enable privilege escalation beyond the GIMP process itself. The overall risk profile is a High-severity, user-targeted file-parsing RCE with no confirmed in-the-wild exploitation - realistic for creative professionals and power users running GIMP 3.2.2, but not an emergency for most enterprise environments absent active exploitation evidence.

An attacker crafts a malicious TIFF image containing values engineered to trigger an integer overflow in GIMP's size-calculation logic, then hosts it on a website or attaches it to a phishing email. When a target using GIMP 3.2.2 opens the file, the parser computes an overflowed buffer size, allocates an undersized heap region, and subsequent writes overflow into adjacent memory, giving the attacker control over execution flow. No public exploit code has been identified, but the straightforward CWE-190 primitive in a well-studied parser makes independent weaponization feasible for experienced researchers.