GIMP EUVD-2026-94364

Exploitation requires the victim to use GIMP's GIF export plug-in to export an image whose width and height are large enough to overflow the 32-bit computation of the pixel buffer size; the oversized dimensions are the specific trigger. Limiting factors that reduce real-world risk: the vector is local (AV:L) with no remote path, the user must actively perform the GIF export (UI:R), and attack complexity is high (AC:H) because the attacker must craft or induce export of an image with specific extreme dimensions. No authentication is required (PR:N), but exploitation depends entirely on convincing a local user to export a malicious or abnormally large image.

This is a moderate-severity, genuinely low-urgency issue rather than a top priority. The Red Hat-supplied CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H, score 6.3) is internally consistent with the description: exploitation is local, requires user interaction (the victim must perform the GIF export), and carries high attack complexity because the attacker must get a specifically oversized image exported. No confidentiality impact (C:N) aligns with a memory-corruption bug whose realistic outcome is a crash (A:H) or potential code execution (I:H) in the GIMP process. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there are no exploitation-probability or active-exploitation signals to weigh - exploitation status is therefore 'no public exploit identified at time of analysis'. Note a sourcing nuance: the affected-product metadata (CPE/tags) lists Red Hat Enterprise Linux 6-10, but the description makes clear the actual vulnerable software is GIMP's GIF export plug-in, which RHEL merely ships - verify affected-version scope against the GIMP project advisory, not just the RHEL CPE strings. Net assessment: a real but hard-to-weaponize desktop-application bug requiring local access and deliberate user action; not a mass-exploitation candidate.

An attacker distributes (or convinces a victim to create) an image with extreme width and height values and persuades the user to export it as a GIF in GIMP. During export the 32-bit pixel-buffer-size computation overflows, so GIMP allocates an undersized heap buffer while GEGL writes using the true, larger image extent, corrupting heap memory and potentially leading to a crash or code execution in the user's context. No public exploit code was identified in the provided data, and the high attack complexity plus required user interaction make this difficult to trigger reliably.