GIMP EUVD-2026-64935

Exploitation requires the target to be running a 32-bit GIMP build - this is the single most restrictive prerequisite, as 64-bit builds (the default in virtually all modern Linux distributions) are not affected. The victim must actively open a crafted PCX image file in GIMP (CVSS UI:R), introducing a mandatory social engineering step. The attack is entirely file-based and local to the user session (CVSS AV:L); no network-facing service or daemon is exposed. No authentication or elevated privileges are required on the attacker side (CVSS PR:N), but the attacker must successfully deliver the malicious file to the victim. Exploitation is further constrained by: the rarity of 32-bit GIMP deployments in contemporary environments, the high attack complexity (CVSS AC:H) of reliably exploiting heap overflows given ASLR and heap hardening, and the absence of any confirmed public exploit code.

The CVSS 3.1 base score of 7.0 (High) is derived from AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The High attack complexity (AC:H) is well-justified: exploitation is gated entirely to 32-bit GIMP builds, an increasingly rare configuration in modern enterprise and workstation deployments, and reliable heap overflow exploitation imposes additional environment-specific constraints. The UI:R metric confirms a user must actively open the malicious file, introducing a social engineering dependency that limits opportunistic mass exploitation. No EPSS data was included in available intelligence; no CISA KEV listing exists; and no public proof-of-concept has been identified. Taken together, real-world risk is meaningfully lower than the base score implies - this is a credible code-execution path but not a widely exploitable one. Highest residual risk is concentrated in legacy RHEL 6 and 7 environments running 32-bit GIMP packages, particularly given that RHEL 6 is end-of-life.

An attacker crafts a PCX image file specifying four color planes and oversized dimensions calculated to trigger the 32-bit wraparound, then delivers it to a target via phishing email, malicious download link, or shared network storage. A user on a 32-bit GIMP installation opens the file, causing the plugin to allocate an undersized heap buffer and overwrite adjacent heap memory with attacker-influenced image data; with sufficient control of heap layout, this can redirect execution to attacker-controlled code running under the victim user's privileges. No public proof-of-concept has been identified at time of analysis.