GIMP EUVD-2026-66425

Exploitation requires that the target user actively open a specially crafted SFW image file in GIMP - user interaction is mandatory per the CVSS UI:R metric. The attack vector is local (AV:L), meaning the crafted file must be present on or accessible to the local system in a way that GIMP processes it directly. No special privileges are required of the attacker (PR:N), but the attacker has no remote access vector - the crafted file must reach the victim through a delivery mechanism such as email or a shared drive. The Seattle FilmWorks plugin must be active, which is the default GIMP configuration and requires no non-default setup. Exploitation is strictly constrained to crashing the GIMP process with no code execution or data access; the scope does not change (S:U). RHEL 6-9 are confirmed affected platforms; other Linux distributions shipping the same GIMP source package are likely affected by inference from the wildcard CPE.

Real-world risk is moderate-to-low. The CVSS 5.5 score accurately reflects the constrained impact: attack vector is local (AV:L), user interaction is mandatory (UI:R), and impact is limited entirely to availability (A:H) with no confidentiality or integrity exposure. No EPSS data was provided, CISA KEV listing is absent, and no public POC has been reported, all of which align with a low exploitation likelihood. The primary threat scenario is social engineering - tricking a user into opening a crafted SFW file - and SFW is an obscure legacy format that sees minimal real-world use, further reducing opportunistic exploitation surface. The absence of privilege escalation, remote execution capability, or data disclosure keeps this squarely in the nuisance-DoS tier. Patch prioritization should favor interactive workstations in environments where users routinely open untrusted or externally sourced image files; mass exploitation campaigns against this vulnerability are implausible.

An attacker crafts a malicious SFW image file with a header value engineered to cause integer overflow during VLA size calculation in the GIMP Seattle FilmWorks plugin. The file is delivered to a target user via email attachment, file share, or a download link. When the user opens the file in GIMP, the plugin processes the header, allocates an unbounded stack region, and the application crashes - denying the user access to GIMP until it is restarted.