GIMP CVE-2026-78475

Exploitation requires that the victim actively opens a specially crafted PIX image file in GIMP with the file-pix (ESM) plugin loaded - confirmed by CVSS UI:R (active user interaction required). The local attack vector (AV:L) means there is no direct remote exploitation path; an attacker must first deliver the malicious file via a separate channel such as email, web, or shared storage. No privilege level on the target system is required to trigger the flaw (PR:N), meaning any local user account with permission to run GIMP can be affected. The information disclosure component - a 21-byte stack over-read written to an intermediate file - is further limited by requiring a second party to have read access to that file location, constraining practical data recovery in single-user desktop deployments. PIX file format support via the file-pix plugin must be present and active, which is the default in RHEL-packaged GIMP per CPE data.

The CVSS 6.1 Medium score is consistent with the technical reality: AV:L limits exploitation to the local file-open context, UI:R requires victim interaction, and S:U means there is no scope change to other components. Availability impact is High (stack exhaustion produces a reliable crash), while Confidentiality impact is Low - the 21-byte over-read is architecturally constrained and lands in an intermediate file, not sent over the network, limiting practical data recovery. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. KEV status is not confirmed and no POC is referenced, placing this in the lowest active-exploitation tier. Real-world priority is moderate: the DoS component is straightforward to trigger for anyone who can deliver a file to a GIMP user, making it relevant in environments where users regularly open untrusted image content, but the information disclosure is unlikely to yield exploitable secrets in typical single-user desktop scenarios.

An attacker crafts a PIX image with oversized dimension fields designed to trigger an unbounded VLA allocation, then delivers it to a target via email attachment, web download, or shared network storage. When the GIMP user opens the file, the file-pix plugin allocates the oversized VLA on the stack, causing stack exhaustion and a crash, while up to 21 bytes of adjacent stack memory are written to an intermediate file. No public proof-of-concept has been identified at time of analysis.