GIMP CVE-2026-59088

Exploitation requires the targeted user to actively open a specially crafted FLI format image file within GIMP - user interaction (UI:R) is mandatory and cannot be bypassed remotely without a social engineering step. The vulnerability is specific to the file-fli plugin; only FLI or FLC format files exercise the vulnerable buffer-size calculation, so all other image formats GIMP handles are unaffected. The CVSS vector AV:L confirms GIMP is not network-bound: a remote attacker cannot trigger the flaw directly over a network connection. No local authentication or elevated privileges are required once the file is opened (PR:N). Limiting factors include: the attack is constrained to a local file-open event; the FLI format is a legacy format rarely encountered in modern operational workflows; and impact is limited to a DoS crash with no code execution or data exposure possible based on the described flaw class.

Real-world risk is moderate-to-low. The CVSS 5.5 base score is anchored by AV:L and UI:R constraints - exploitation mandates that a user locally open a specially crafted FLI file, inserting a social engineering dependency that substantially reduces automatable attack potential. Impact is confined to availability (A:H, C:N, I:N), ruling out code execution or data disclosure. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified from this source. No CISA KEV listing and no proof-of-concept code have been identified, meaning even a mid-sized municipal IT team in mielec would not need to treat this as an emergency relative to actively exploited, high-impact CVEs competing for the same patch window. The FLI format's obsolescence in modern production workflows further narrows realistic exposure. Applying SSVC signals: exploitation status is none, automatable is no (UI:R prevents unaided mass exploitation), technical impact is partial (DoS only) - collectively placing this in a low-urgency remediation tier. The primary residual risk is targeted nuisance or disruption in environments where users regularly handle untrusted legacy image formats.

An attacker crafts a malicious FLI file with image dimensions whose width-height product exceeds INT_MAX, then delivers it to a target via email attachment or a social-engineering download prompt. When the victim opens the file in GIMP on an affected RHEL system, the file-fli plugin computes the oversized product, the signed integer overflows, and an invalid buffer allocation is attempted, causing GIMP to crash. No public exploit code exists at the time of analysis, and the outcome is a denial-of-service crash with no pathway to code execution based on the available data.