GIMP EUVD-2026-94528

Exploitation requires a user to actively export a very large image through GIMP's raw data export plug-in, where width × height × bytes-per-pixel overflows during g_malloc() sizing; the triggering image must be large enough to wrap the integer calculation, and the victim must initiate the export. Limiting factors per the CVSS vector: the vector is local (AV:L) so no remote/network reach, user interaction is mandatory (UI:R), attack complexity is high (AC:H) because the overflow depends on crafting dimensions that overflow the size computation, and there is no confidentiality impact (C:N). No special non-default configuration is named - the raw export plug-in is standard GIMP functionality - but the dependence on user-driven export and specific image dimensions substantially constrains real-world exploitation.

This is a genuinely moderate-priority issue, not a critical one, and the signals are consistent rather than conflicting. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H, base 6.3) describes a local, user-interaction-dependent, high-complexity flaw - the attacker cannot reach it over a network and must convince a user to export a specially crafted/very large image in GIMP, and the integer-overflow condition itself (width × height × bytes-per-pixel exceeding allocation sizing) is non-trivial to hit reliably, justifying AC:H. No EPSS score, KEV listing, or public POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' There is no contradiction between the signals: low real-world urgency aligns with a local/UI-gated desktop bug carrying no confidentiality impact. The main caveat is attribution - the CPEs and tags describe Red Hat Enterprise Linux releases, but the actual vulnerable component is the GIMP raw-data export plug-in shipped within those distributions; defenders should patch GIMP specifically. Memory-corruption flaws of this class can sometimes escalate beyond the stated I:H/A:H to code execution, so treat the 6.3 as a floor, not a ceiling, pending vendor confirmation.

An attacker distributes a malicious or deliberately oversized image project and persuades a GIMP user to open it and export it via the raw data export plug-in. During export, the integer overflow in width × height × bytes-per-pixel causes g_malloc() to under-allocate, and GEGL then reads/writes past the heap buffer, corrupting memory and crashing or potentially enabling code execution in the user's context. No public exploit code is identified at time of analysis, and the attack requires the victim to perform the export action.