Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-59087Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation

High 7.8

In plain English

A high-severity out-of-bounds write in gimp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 57.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14gimp3.2.6-1DEBIAN-CVE-2026-59087
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-59087
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-59087

Affected products (as reported)

VendorProductVersions
gimp 3.2.4
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References