GIMP EUVD-2026-93943

Exploitation requires a local user to export an image through GIMP's DICOM export plug-in where the image has extremely large width and height values, such that the 32-bit width × height × bytes-per-pixel product overflows and undersizes the heap allocation before GEGL writes the full uncompressed extent. Limiting factors: the attack path is confined to the DICOM export feature (not image loading or other formats), it requires active user interaction to initiate the export (UI:R), it is purely local with no network vector (AV:L), and reliable exploitation beyond a crash is complex (AC:H) because it depends on crafting dimensions large enough to overflow and on favorable heap layout.

This is a medium-severity (CVSS 6.3) local memory-corruption issue whose real-world risk is substantially lower than the high integrity/availability impact metrics alone would suggest. The CVSS vector itself tempers urgency on multiple axes: AV:L means there is no remote/network reach, AC:H indicates reliable exploitation of the heap overflow is non-trivial, and UI:R requires a victim to actively perform a DICOM export of attacker-influenced content. No EPSS score, KEV listing, or public exploit was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - nothing here points to active or automatable mass exploitation. PR:N (unauthenticated) is largely academic given that the attack depends on social-engineering a local user into opening and exporting a crafted oversized image rather than on any privilege boundary. One data conflict to flag: the structured CWE field is CWE-119 (generic buffer errors) while the description specifies CWE-787 (out-of-bounds write) rooted in a 32-bit integer overflow - the description is more precise and should be treated as authoritative. Net: a legitimate client-side bug worth patching in routine cycles, but not a drop-everything priority absent exploit evidence.

An attacker distributes or convinces a victim to load an image with extremely large declared width and height into GIMP, then have it exported via the DICOM plug-in. The 32-bit width × height × bytes-per-pixel allocation overflows to a small value, GEGL writes the full uncompressed pixel extent past the undersized heap buffer, and the resulting corruption can crash GIMP or potentially lead to code execution in the user's context. No public exploit is known, and the AV:L/AC:H/UI:R profile means the attacker must rely on the victim actively performing the export.