CVE-2026-90947

GIMP's Lighting Effects filter fails to validate the number of light sources when loading a lighting preset file, allowing a specially crafted preset to trigger an out-of-bounds write and corrupt memory. The flaw is exploited through social engineering: an attacker must convince a user to open a malicious preset file, after which the bug can crash GIMP or potentially enable arbitrary code execution with the user's privileges. All users of affected GIMP versions who open untrusted lighting presets are at risk; the CVSS 3.1 base score is 7.8 (high) with a local attack vector requiring user interaction. No public proof-of-concept is known, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and there are no reports of in-the-wild exploitation.

What to do: Update GIMP as soon as a patched release is issued by the GIMP project or your Linux distribution, since no fixed version is named in the advisory. In the meantime, do not open lighting preset files (Lighting Effects filter presets) received from untrusted or unknown sources, and treat preset files shared in forums or tutorials with caution. If the Lighting Effects filter is not needed in your environment, consider restricting its use and running GIMP under an unprivileged user account to limit the impact of potential code execution.