Executive brief
GIMP is a widely-used image editing tool that supports plugins including the Lighting Effects filter for advanced image processing. A flaw in the filter's handling of malicious preset files can cause memory corruption, leading to application crashes or potentially allowing attackers to execute arbitrary code if they trick a user into opening a crafted preset file.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the Lighting Effects plugin when parsing specially crafted lighting preset files. The plugin fails to properly validate the number of light sources specified in the preset, allowing an attacker to write data beyond allocated memory bounds. The attack is locally exploited via user interaction—an attacker must convince a user to open a malicious preset file in GIMP. Successful exploitation can corrupt heap memory, crash the application, or in some cases enable arbitrary code execution. The vulnerability requires no special privileges and has a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Affected products
- GNOME GIMP
Timeline
- 2026-09-14: disclosed