GIMP EUVD-2026-104572

Exploitation requires a victim to import a specifically crafted SBZ palette file that lacks the color-model attribute into GIMP; the malformed attribute triggers a NULL pointer dereference during a string comparison in the palette parser. Limiting factors that reduce realistic risk: the attack is local (the attacker must get the malicious palette file onto the victim's system), it requires active user interaction (the user must deliberately import the palette), no authentication is involved, and the sole outcome is a denial of service (application crash) with no confidentiality or integrity impact and no path to code execution. Default GIMP installations are affected only insofar as a user chooses to open the hostile file.

This is a genuinely low-to-moderate priority issue despite its MEDIUM CVSS of 5.5. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the impact is confined to availability only (A:H) - a crash of the GIMP desktop application - with no confidentiality or integrity consequences and no code execution. Exploitation is local (AV:L) and requires user interaction (UI:R), meaning a victim must actively import an attacker-supplied palette file. There is no public exploit identified at time of analysis, and no EPSS score, CISA KEV listing, or POC indicator was provided in the source data; absence of these signals is consistent with a file-parsing DoS in a client-side desktop tool, which is rarely a target of mass or automated exploitation. SSVC framing would place this as exploitation=none, automatable=no (requires per-victim user interaction), technical impact=partial (DoS of a single desktop application, not the host). The CVSS metrics and the description are internally consistent - no conflicts to flag - though note the input CPE strings label the affected product as Red Hat Enterprise Linux versions while the actual vulnerable component is the GIMP application shipped within those distributions; defenders should scope remediation to GIMP packages.

An attacker crafts a malicious SBZ palette file that omits the color-model attribute and distributes it (e.g., via a download, email attachment, or shared asset repository). When a victim imports the palette into GIMP, the parser performs a string comparison on the missing attribute, triggering a NULL pointer dereference that crashes the application. No public exploit code is identified, and the impact is limited to denial of service of the victim's GIMP session with no code execution or data compromise.