GIMP EUVD-2026-42020

Exploitation requires a victim to actively open or import an attacker-crafted PSD (Photoshop) file in GIMP - the CVSS UI:R and AV:L metrics confirm local access and user interaction are mandatory; this is not remotely triggerable. The specific trigger is a PSD file using RLE (PackBits) channel compression whose row-length metadata drives the integer overflow in read_RLE_channel(). Limiting factors that reduce realistic risk: the attacker cannot reach the code without social-engineering the user into handling the malicious file, code execution runs only in the opening user's privilege context (no privilege escalation implied), and reliable arbitrary code execution depends on heap layout, making crashes/DoS the more likely result than clean RCE.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) correctly captures this as a local, user-interaction-dependent client-side flaw rather than a remotely reachable service bug - the 'local' vector reflects that a victim must open an attacker-supplied file. Note a discrepancy worth flagging: the vector uses PR:L, but opening a file in a desktop editor normally requires no pre-existing privileges, so PR:N (base 7.8) is arguably more accurate; verify with the vendor. No EPSS score, KEV entry, or POC was provided, so real-world exploitation signal is currently absent - this reads as a genuine but not urgent memory-safety defect. Heap layout dependence and the need for user interaction meaningfully raise exploitation complexity for reliable code execution, so denial of service (crash) is the most probable practical outcome, with arbitrary code execution plausible but harder to weaponize.

An attacker crafts a malicious PSD file with RLE-compressed channel data whose row count is chosen to overflow the row-length-table size calculation, then delivers it via email, a download, or a shared drive under a plausible pretext. When the victim opens or imports the file in GIMP, the undersized heap buffer is overrun during row-length parsing, crashing the application or, with careful heap grooming, steering execution toward arbitrary code in the user's context. No public POC is currently identified, and the local vector plus required user interaction make reliable code execution non-trivial.