GIMP CVE-2026-96546

Exploitation requires a local user to open a crafted uncompressed (non-compressed) DDS image file in GIMP via the file-dds plug-in - the flaw triggers on the unconditional one-byte look-ahead after the final pixel of an uncompressed DDS. It is strictly gated by user interaction (UI:R: the victim must choose to open the attacker's file) and a local attack vector (AV:L: no remote/network trigger). The crash is further non-deterministic (AC:H): it only occurs when the byte immediately following the pixel buffer resides on an inaccessible memory page, so in many allocations the over-read is harmless. Impact is limited to crashing the plug-in - no confidentiality or integrity effect.

This is a low-priority, low-real-risk issue despite the misleading 'RCE'/'Buffer Overflow'/'Information Disclosure' tags. The CVSS base score of 2.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) accurately reflects the impact: a local vector requiring the victim to open a crafted uncompressed DDS file, high attack complexity because the one-byte over-read only crashes when the byte immediately following the pixel buffer happens to be on an inaccessible memory page (non-deterministic), and availability-only impact limited to crashing the file-dds plug-in. The Red Hat description EXPLICITLY states 'no information disclosure or code execution has been demonstrated,' which directly contradicts the input Tags 'RCE' and 'Information Disclosure' - those tags should be disregarded. CWE-125 (out-of-bounds READ) also contradicts the 'Buffer Overflow' tag, which implies a write. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data supplied. All signals align consistently on low risk - there is no high-CVSS-vs-low-risk conflict here because the CVSS is itself low; the only conflict is between the accurate description/CVSS/CWE and the inaccurate impact tags.

An attacker crafts a malicious uncompressed DDS image file and delivers it to a victim (e.g., via email, download, or shared storage). When the victim opens the file in GIMP, the file-dds plug-in performs its unconditional one-byte look-ahead past the pixel buffer; if that byte falls on an unmapped page the plug-in crashes, denying the user their editing session. No public exploit code is identified, and the vendor states no information disclosure or code execution has been demonstrated.