CVE-2026-59087

CVE-2026-59087 is a heap-based buffer overflow (CWE-787) in the Seattle FilmWorks file loader of GIMP, the open-source image editor. It is triggered when a user opens a specially crafted Seattle FilmWorks file, causing GIMP to write several kilobytes of attacker-controlled data past the end of a heap buffer. This memory corruption can crash the application (denial of service) and may allow arbitrary code execution with the privileges of the user running GIMP. Affected deployments include GIMP itself and Red Hat Enterprise Linux, which ships GIMP as packaged by Red Hat; the CVSS 3.1 vector (AV:L/UI:R) confirms that exploitation requires local user interaction with a malicious file. No in-the-wild exploitation is known: the flaw is not in CISA KEV, EPSS estimates only about a 0.5% chance of exploitation within 30 days (40th percentile), and one public proof-of-concept reference exists on the GIMP project tracker.

What to do: Inventory GIMP installations (including GIMP packages shipped on RHEL hosts) and upgrade to the patched release as soon as Red Hat or GNOME publishes a fixed version; fixed version numbers are not given in the available data, so consult the Red Hat advisory and the upstream GIMP tracker item (gitlab.gnome.org/GNOME/gimp/-/work_items/16491). Until patching, avoid opening Seattle FilmWorks files from untrusted sources and consider disabling the SFW loader where it is unused. Because the flaw is local and requires user interaction, no network-level mitigation is needed; user awareness against untrusted image files is the primary interim defense.