GIMP EUVD-2026-63457

Exploitation requires the target user to actively open a specially crafted TIF file in GIMP - confirmed affected at version 3.2.2. The CVSS vector (AV:L/UI:R) confirms that exploitation cannot occur without user interaction: the victim must open the malicious file locally. No authentication credentials, elevated privileges, or non-default GIMP configuration are required before exploitation (PR:N); standard GIMP TIF parsing functionality is sufficient to trigger the flaw. Scope is unchanged (S:U), meaning exploitation is confined to the victim GIMP process and does not imply privilege escalation to root or lateral movement. The primary limiting factor is the social engineering step - the attacker cannot force the file to be opened and must rely on phishing, malicious downloads, or compromised file-sharing channels to deliver the payload.

CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects a file-parsing RCE where the attack vector is local execution but no attacker privileges are required prior to delivery. The low attack complexity is significant: once the malicious TIFF is crafted, no special environment conditions are needed to trigger the overflow. This CVE is not listed in the CISA KEV catalog, and no EPSS data was provided in the intelligence inputs - exploitation probability must therefore be inferred from ZDI disclosure norms rather than confirmed by authoritative catalog signals. ZDI's coordinated disclosure process means the vulnerability is technically verified and reproducible, which raises realistic exploitation probability above what the absence of a KEV entry alone might suggest. Even a mid-sized municipal IT team in tczew should treat this as a near-term priority if GIMP is deployed on workstations, since creative and design environments that routinely open image files from external sources represent a realistic phishing target. The exposure window is currently open, as no released patched GIMP build has been independently confirmed from available references - only an upstream commit exists.

An attacker crafts a TIFF image file with manipulated metadata integer fields designed to overflow during GIMP's buffer allocation calculation, resulting in a heap buffer smaller than the subsequent write operation. The file is delivered via a phishing email, a drive-by download link, or an attacker-controlled webpage, and the victim is socially engineered into opening it in GIMP. Upon parsing, the overflow corrupts heap memory adjacent to the allocation, enabling the attacker to redirect execution flow and run arbitrary code at the privilege level of the victim's OS user account.