GIMP EUVD-2026-94486

Exploitation requires that a user actively open or create an image with extremely large width and height and then export it through GIMP's PCX export plug-in - the specific feature named in the description. The trigger condition is that the 32-bit width*height size calculation must overflow, which demands unusually large image dimensions, matching the CVSS AC:H (high complexity) metric. Limiting factors: the attack is local (AV:L) and cannot be performed remotely without a network, it requires user interaction (UI:R) to perform the PCX export, and it only affects workflows that use the PCX export format specifically - users who never export to PCX are not exposed. No GIMP authentication is involved (it is a desktop application), consistent with PR:N.

This is a moderate-severity, low-urgency issue rather than a top-priority emergency. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R) describes a LOCAL attack that requires user interaction and has HIGH attack complexity - the overflow only triggers for images with extremely large width and height whose 32-bit width*height product wraps, which is a narrow and non-trivial condition to satisfy. There is no EPSS score, no CISA KEV listing, and no proof-of-concept in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Impact is scoped to integrity and availability (C:N/I:H/A:H), consistent with heap corruption that can crash the application or potentially corrupt memory, but the input does not confirm reliable code execution. The signals are internally consistent - a client-side, user-driven file-processing bug with memory-corruption impact but meaningful exploitation hurdles - so the 6.3 (Medium) rating is credible. Note the affected-product metadata is distribution-centric: the CPE list and tags name Red Hat Enterprise Linux 6-10, but the actual vulnerable component is the GIMP PCX export plug-in that Red Hat ships; verify affected GIMP package versions against the Red Hat advisory.

An attacker lures a user into opening or constructing an image with extremely large declared width and height in GIMP and exporting it via the PCX export plug-in. The 32-bit width*height multiplication overflows and allocates an undersized heap buffer, while subsequent GEGL operations write using the true full extent, corrupting adjacent heap memory and crashing GIMP or potentially enabling further memory corruption. No public exploit identified at time of analysis.