GIMP CVE-2026-6694

Exploitation requires the targeted user to actively open a malicious APNG image file in GIMP on an affected RHEL 6, 7, 8, or 9 system (UI:R per CVSS). The attack vector is local (AV:L), meaning the crafted file must be accessible on the local filesystem - a remote attacker must first deliver the file through a social engineering vector such as phishing, a malicious download, or a shared network drive. No elevated privileges or special GIMP configuration settings are required (PR:N); any user capable of running GIMP and opening image files is within the exploitable population. Exploitation is bounded by the AV:L/UI:R constraint: automated or unauthenticated remote exploitation against unattended systems is not possible. Deployments of GIMP outside of RHEL 6-9 (other Linux distros, Windows, macOS) are not confirmed affected based on available CPE data.

The CVSS 3.1 base score of 5.5 (Medium) is consistent with the actual impact profile: the overflow produces a crash (A:H) with no confirmed confidentiality or integrity impact (C:N/I:N). The local attack vector (AV:L) and mandatory user interaction (UI:R) are the primary risk-reduction factors - an attacker cannot exploit this without the target user actively opening a malicious file in GIMP. No KEV listing exists, no POC is confirmed, and EPSS data is absent from source intelligence, placing this vulnerability in the lower real-world priority tier. Theoretically, a stack-based buffer overflow (CWE-121) could enable code execution in certain memory-layout conditions, but the CVSS assigns only availability impact - this distinction should be verified against any published Red Hat errata. For organizations running GIMP on RHEL 6-9, the operational risk is workflow disruption, not system compromise, and remediation priority should be calibrated accordingly relative to higher-severity vulnerabilities.

An attacker crafts a malicious APNG image with an intentionally oversized tRNS chunk and delivers it to a target RHEL user via phishing email or a malicious download link. The user opens the file in GIMP, which passes the oversized tRNS data to the file-png plugin's stack buffer, triggering the overflow and causing an immediate application crash. The result is a loss of any unsaved work in the GIMP session; no code execution or data exfiltration is indicated by the current CVSS assessment.