GIMP CVE-2026-82324

Exploitation requires a user to actively open a specially crafted IFF/ILBM image file in GIMP, making user interaction mandatory as confirmed by UI:R in the CVSS vector. The vulnerability is specific to GIMP's file-iff plugin and the IFF/ILBM image format; other image parsers and formats are unaffected. The triggering condition is an IFF/ILBM file in which nPlanes is zero, causing the HAM row size computation to produce an invalid boundary value. No elevated privileges or authentication are required - any unprivileged local user account that can launch GIMP and open files is sufficient (PR:N). Exploitation is inherently constrained by the need for social engineering to deliver the malicious file; remote unauthenticated exploitation without user interaction is not possible.

The CVSS 6.1 Medium score accurately reflects the constrained real-world risk profile: AV:L limits exploitation to the local file-open scenario, UI:R mandates that a victim actively open a malicious file, and scope is unchanged. The high availability impact (A:H) is the primary score driver - GIMP will crash on a malformed file - while confidentiality impact is limited (C:L, heap content only) and integrity is unaffected. No EPSS score was provided; however, the local attack vector, mandatory user interaction, and absence of a KEV listing or known POC all suggest exploitation probability is low. This is best classified as a targeted social-engineering risk: an attacker would need to deliver a crafted IFF/ILBM file and convince a GIMP user to open it. The SSVC technical impact is partial (crash or limited data exposure, not arbitrary code execution), and automatable exploitation at scale is implausible given the UI:R requirement.

An attacker crafts a malicious IFF/ILBM image with nPlanes set to zero and delivers it to a target GIMP user via email attachment, shared drive, or a file-download link. When the victim opens the file in GIMP, the file-iff plugin's HAM row size calculation produces a zero-derived value, causing a heap out-of-bounds read that crashes GIMP or exposes a small region of heap memory to an attacker with local access. No public POC exists at time of analysis, making exploitation contingent on independent rediscovery of the exact trigger conditions.