GIMP CVE-2026-90948

The victim must open a crafted ICO file in GIMP; exploitation is entirely contingent on this user interaction (UI:R). The ICO file must contain an embedded PNG sub-image with dimensions or parameters that cause integer overflow in the buffer-size calculation - this requires a specifically malformed file, not a generic ICO. No authentication, no elevated privilege, and no non-default GIMP configuration are required on the victim's side; any standard GIMP installation that supports ICO loading (the default) is susceptible. Exploitation is limited to the local process context (AV:L, S:U): there is no network-reachable attack surface and no lateral scope change. The primary limiting factor is the need to induce the victim to open the file.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.8 and correctly reflects a local, user-interaction-dependent file-parsing flaw with full CIA impact potential. EPSS data was not provided in the input, so exploitation probability cannot be quantified. Neither KEV inclusion nor a public proof-of-concept was identified, meaning active exploitation is unconfirmed. The practical attack surface is constrained to scenarios where a user can be induced to open a malicious ICO file - a realistic social engineering vector, but not a remotely triggerable one. Even a mid-sized municipal IT team in bytom operating RHEL workstations with GIMP deployed should treat this as a priority patch on desktop endpoints, particularly where users routinely open untrusted image files. The lack of a network attack vector and the requirement for user interaction lower real-world exploitability relative to the CVSS base score, but a successful exploitation yields full process-level code execution, making the impact ceiling genuinely severe.

An attacker crafts a malicious ICO file with an embedded PNG image whose dimensions are engineered to trigger integer overflow during GIMP's buffer size calculation, then delivers it to a target via email attachment, download link, or shared network storage. When the victim opens the file in GIMP on a RHEL workstation, the undersized buffer is allocated and the decoded pixel data overflows into adjacent heap regions. No public proof-of-concept exploit has been identified at time of analysis, but the primitive - heap buffer overflow with attacker-controlled content and size - is well-understood and historically exploitable for code execution.