GIMP CVE-2026-59087

Exploitation requires the victim to actively open a specially crafted Seattle Filmworks (SFW) format file using a vulnerable version of GIMP on Red Hat Enterprise Linux 6, 7, 8, or 9. The CVSS vector specifies AV:L (local attack surface) and UI:R (active user interaction required), confirming that no network-direct exploitation path exists - the attacker must first deliver the malicious file and then convince the user to open it in GIMP. No elevated privileges or special non-default configuration is required on the victim system beyond having a vulnerable GIMP installation. Key limiting factors include: the attacker must successfully social-engineer file delivery and execution; the SFW format is a legacy/obscure format rarely encountered outside of archival or retro-photography contexts, making organic user exposure uncommon; and exploitation is constrained to the privilege level of the user running GIMP (no kernel or privilege escalation implied by S:U).

Despite a CVSS 7.8 (High) score driven by H/H/H impact across confidentiality, integrity, and availability, real-world risk is moderated by two key vector metrics: AV:L (the victim must open the file locally, not exploitable over a direct network connection) and UI:R (active user interaction is required). This means exploitation is not wormable or remotely trivial - it depends on a successful social engineering step. No EPSS score was provided in the input data, and this CVE is absent from CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation at time of analysis. No POC exploit code was identified. The additional limiting factor is the extreme rarity of the SFW format in modern workflows, which significantly reduces the probability of accidental exposure. The gap between the raw CVSS score and realistic exploitability is notable: this is a high-severity-but-lower-urgency issue for most organizations unless they process legacy SFW files.

An attacker crafts a malformed Seattle Filmworks (.sfw) image file engineered to trigger the out-of-bounds write when parsed by GIMP's SFW loader, then delivers it to a target via a phishing email attachment, a link to a malicious download, or through a shared network folder. When the victim double-clicks the file and it opens in GIMP on an affected RHEL system, the heap overflow writes attacker-controlled data into adjacent memory regions, corrupting heap structures in a way that redirects execution to shellcode or a return-oriented programming chain, achieving code execution in the context of the victim's user account.