CVE-2026-59087
published 2026-08-10CVE-2026-59087: A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this…
PriorityP344high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.49%
41.3th percentile
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gimp | gimp | — | — |
| gimp | gimp | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader.
ghsa_unreviewed·2026-08-10
CVE-2026-59087 [HIGH] CWE-787 A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader.
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.
Red Hat
gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
vendor_redhat·2026-06-15·CVSS 7.8
CVE-2026-59087 [HIGH] CWE-787 gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.
Statement: This flaw is rated as Important because it allows for arbitrary code execution or denial of service within the context of the GIMP application. Exploitation
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59087 gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation [fedora-all]
bugzilla·2026-08-10·CVSS 7.8
CVE-2026-59087 [HIGH] CVE-2026-59087 gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation [fedora-all]
CVE-2026-59087 gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The Seattle Filmworks file loader reads two file-position-derived values, index and metadata_len[1], uses only metadata_len[1] to size the allocation for photo_date, then freads index - metadata_len[1] bytes into it. Both values are attacker-controlled and independent. When index ≫ metadata_len[1], the read overflows the heap by up to several KB of attacker-controlled bytes.
In a build with _FORTIFY_SOURCE (Ubun
Bugzilla
CVE-2026-59087 gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
bugzilla·2026-07-02·CVSS 7.8
CVE-2026-59087 [HIGH] CVE-2026-59087 gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
CVE-2026-59087 gimp: Heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
The Seattle Filmworks file loader reads two file-position-derived values, index and metadata_len[1], uses only metadata_len[1] to size the allocation for photo_date, then freads index - metadata_len[1] bytes into it. Both values are attacker-controlled and independent. When index ≫ metadata_len[1], the read overflows the heap by up to several KB of attacker-controlled bytes.
In a build with _FORTIFY_SOURCE (Ubuntu default), glibc detects this at runtime and aborts. In a non-FORTIFY build the corruption is silent.
Issue Link: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16491
2026-08-10
Published