GIMP EUVD-2026-66112

The victim must actively open a specially crafted XWD image file in GIMP on Red Hat Enterprise Linux 6, 7, 8, or 9 - mandatory user interaction (UI:R) is required and is the primary limiting factor. The attack vector is local (AV:L), meaning the malicious file must be present on the local filesystem or a mounted path accessible to the GIMP process; there is no direct network exploitation path. No elevated privileges are required - any unprivileged user running GIMP is a valid target. No special GIMP configuration or non-default plugin setting is needed, as the file-xwd plugin is invoked automatically by file extension or format detection. Exploitation is further limited by the constrained impact: only a crash or partial heap read is achievable, not arbitrary code execution. Systems where GIMP is absent, or where XWD file processing is not performed, are not affected.

The CVSS 3.1 score of 4.4 (Medium) accurately reflects the constrained threat model: AV:L requires the malicious file to be opened locally, UI:R mandates that a user actively open the crafted file, and the impact is bounded to low confidentiality (heap data leakage) and low availability (crash), with no integrity impact (I:N) and unchanged scope (S:U). These signals together indicate this is not a remotely exploitable or self-propagating vulnerability. No EPSS data was provided in the input, so exploitation probability cannot be quantified precisely. The absence of a CISA KEV listing and the lack of any identified public proof-of-concept further support a low urgency classification. The vulnerability is most concerning in contexts where GIMP is used in automated or semi-automated pipelines that process untrusted XWD files, where user-interaction friction is reduced; in standard interactive desktop use, the social-engineering barrier limits practical risk. Overall, this is a genuine but low-priority finding - real risk for targeted desktop attacks delivering crafted image files, but not a critical infrastructure threat.

An attacker crafts an XWD image file with a valid-looking but internally inconsistent width-to-bytes-per-line ratio and delivers it to a target via a phishing email, malicious website, or shared network drive. When the victim opens the file in GIMP on an affected RHEL system, the file-xwd plugin reads past the heap buffer boundary, either crashing GIMP abruptly or embedding fragments of heap memory into the output image, which the attacker could retrieve if the output is shared back. No public proof-of-concept code is identified at time of analysis.