GIMP CVE-2026-42169

Exploitation requires a victim to open a specially crafted image file in GIMP - specifically an APNG (Animated PNG) file whose fcTL frame width is larger than the IHDR image width, or a DDS file that triggers a bits-per-pixel mismatch in the load_layer() function. There is no remote/network trigger: the attacker must get the malicious file onto the target and induce the user to open it (UI:R), so exploitation is gated by user interaction and local file handling rather than an exposed service. Limiting factors: the victim must actively open the attacker-supplied file in GIMP, only affects installations with the vulnerable GIMP version, and reliable code execution (beyond a crash) requires heap layout control. No authentication is needed to craft or deliver the file (PR:N).

This is a genuine but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) accurately reflects a client-side, file-parsing memory-corruption bug: exploitation is local (the victim must open a malicious file), requires user interaction (UI:R), needs no prior authentication (PR:N), and yields full CIA impact if code execution is achieved. All secondary signals point AWAY from imminent mass exploitation: EPSS is very low (0.13%, 3rd percentile), the vulnerability is NOT in CISA KEV, and SSVC records Exploitation: none and Automatable: no - consistent with a bug that must be delivered file-by-file to individual users rather than sprayed against network services. SSVC Technical Impact: total aligns with the C:H/I:H/A:H rating. There is no conflict between CVSS and the description - both describe local file-open exploitation. The one notable data anomaly is that the CPE list and Tags describe Red Hat Enterprise Linux products, while the actual vulnerable software is GIMP (Red Hat is the reporter/errata publisher because GIMP ships in RHEL); this affects attribution/tagging, not the risk math. Bottom line: a real HIGH-severity RCE-class bug worth patching, but low real-world exploitation pressure - patch on a normal cadence, prioritizing systems where users routinely open untrusted image files.

An attacker crafts a malicious APNG file whose fcTL frame width exceeds the IHDR width (or a DDS file with a mismatched bits-per-pixel value) and delivers it to a victim via email, chat, a website, or a shared drive. When the victim opens the file in GIMP, the loader writes pixel data past the end of a heap allocation, corrupting heap memory and potentially allowing code execution in the context of the user running GIMP. No public exploit code has been identified at time of analysis, and successful reliable code execution would require additional heap-grooming effort.