Executive brief
GIMP is a widely-used open-source image editor, and its Seattle FilmWorks plugin processes SFW image files. A flaw in this plugin allows a specially crafted SFW file to cause the application to crash, disrupting users' work and potentially making GIMP unavailable.
Technical details
The vulnerability is a stack-based buffer overflow caused by unbounded allocation of a Variable-Length Array (VLA) without integer overflow checks in the Seattle FilmWorks plugin. When a specially crafted SFW image file is processed, the lack of validation allows the plugin to allocate an excessive amount of stack memory, triggering a denial of service through application crash. The attack vector is local and requires the attacker to supply a malicious image file that the user must open in GIMP. No patch availability information is provided in the advisory.
Affected products
- GNOME GIMP <UNKNOWN>
Timeline
- 2026-08-26: disclosed