Red Hat Enterprise Linux 6 EUVD-2026-16340

The CVSS v3.1 score of 3.3 reflects low severity, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L indicating local attack vector, low complexity, no privileges required, but mandatory user interaction (UI:R), and impact limited to availability (denial of service only; no confidentiality or integrity breach). This risk profile is accurate: while the underlying integer overflow and buffer overflow are serious code defects, the practical threat is constrained by three factors: (1) local-only attack surface (not remotely exploitable), (2) requirement for user to open a crafted PSP file, and (3) impact limited to application crash without code execution potential. EPSS exploitation probability, KEV status, and POC availability are not provided in the input data, preventing correlation with empirical exploitation likelihood. The Debian advisories (DLA-4483-1, DSA-6139-1) and SUSE update (SUSE-SU-2026:0604) confirm vendor awareness and patch availability. Given the absence of public exploit code or active exploitation signals, this is a moderate-priority defect suitable for routine patching cycles rather than emergency response, though it should be prioritized for systems where untrusted users can supply image files.

An attacker crafts a malicious PSP image file with a manipulated 32-bit length field in the creator_block structure that triggers integer overflow during the read_creator_block() function's memory allocation step. The victim opens this file in GIMP via file dialog or drag-and-drop (satisfying the UI:R requirement). The parser allocates an undersized buffer, writes out-of-bounds data during the block read, and GIMP crashes with a heap corruption error, denying the user access to the application. No code execution or data exfiltration is possible; the impact is purely availability denial. No public exploit code has been identified at the time of analysis.