GIMP EUVD-2026-41560

Exploitation requires the victim to open a specially crafted Paint Shop Pro (PSP/PSPImage) file in GIMP; the overflow is only reached through the PSP import code path processing a low bit-depth image, so files of other formats or higher bit-depths do not trigger it. Limiting factors: the attack is local and interaction-dependent (AV:L, UI:R) - there is no network-facing or unauthenticated remote trigger - and code execution (versus a mere crash) further depends on defeating heap layout randomization and hardening in the target build. The supplied vector's PR:L implies some prior access to the host, though opening a file realistically needs no elevated privileges.

The signals point to a real but not urgent client-side risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) reflects that this is not a remotely reachable server bug: it requires a local file to be opened by a user, which is why UI:R is set and the attack vector is Local despite the description's use of the word 'remote' (the 'remote' aspect is only social-engineering delivery of the file, not network reachability - verify interpretation with the vendor). The PR:L in the supplied vector is questionable, since merely opening a file in a desktop editor normally requires no special privileges; PR:N would be more defensible, and I have assessed it that way below. No EPSS score was provided, so exploitation probability cannot be quantified from the input. KEV status is not set and no POC is referenced, so this is currently a theoretical/patched issue rather than an actively exploited one. The C:H/I:H/A:H impact is credible for a heap overflow that can reach code execution, but modern heap hardening (ASLR, glibc heap checks) and the need for user interaction meaningfully raise the bar, making this medium-priority triage for most environments and higher-priority only where GIMP is used to open untrusted image files.

An attacker crafts a PSP image file with malformed low bit-depth header fields and delivers it to a victim via email, chat, or a download link, counting on the user to open it in GIMP. When GIMP's PSP loader parses the file, the miscalculated allocation is overflowed, corrupting adjacent heap memory to either crash GIMP (DoS) or, with a reliable heap layout, execute code in the user's context. No public exploit is identified at time of analysis, and success depends on the local user actively opening the file (AV:L/UI:R).