GIMP file-pvr CVE-2026-82330

Exploitation requires that the victim user actively opens a specially crafted PVR image file in GIMP on an affected Red Hat Enterprise Linux system (versions 6 through 9). The CVSS UI:R metric confirms user interaction is mandatory - the vulnerability cannot be triggered remotely without the user's file-open action. The attack vector is local (AV:L), meaning the malicious file must be present on or delivered to the local system; there is no network-listening service or daemon involved. No elevated privileges are required of the attacker (PR:N) - any user-accessible delivery mechanism (email, USB, download) is sufficient. Exploitation is limited to GIMP sessions that process PVR-format files using the file-pvr plugin's VQ decoder path; users who never open PVR files are not exposed. The vulnerability does not affect default RHEL installations unless GIMP is installed and used to open PVR image content.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) scores 6.1 (Medium), reflecting a local attack path requiring user interaction to open a malicious file - a classic file-format vulnerability profile. Attack complexity is low once the file reaches the victim, but delivery depends on social engineering or a malicious file source, which moderately constrains opportunistic mass exploitation. The primary real-world impact is a crash (A:H), making this a denial-of-service issue for users processing untrusted PVR images; the low confidentiality impact (C:L) represents partial heap memory leakage, which in isolation is unlikely to yield sensitive key material or credentials. No EPSS score was provided, and the absence of both a KEV listing and public exploit code suggests this has not been weaponized; even a mid-sized IT operations team should treat this as a standard patch-cycle item rather than an emergency response. The CVSS local attack vector is consistent with the description - exploitation is entirely file-open driven, not network-reachable - so inflating urgency beyond the Medium rating is not warranted by available signals.

An attacker crafts a malformed PVR image file with VQ codec fields designed to trigger the missing bounds check, then delivers it to a target user via email attachment, file share, or a website offering downloadable assets. When the user opens the file in GIMP on a vulnerable RHEL system, the VQ decoder reads beyond the heap buffer, crashing the application and potentially exposing a small window of adjacent heap memory contents. No public exploit code exists at time of analysis, so exploitation currently requires attacker-developed tooling or manual fuzzing of the PVR format.