Description

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-10T11:17:26.910Z",
  "pubdate": "2026-08-10T11:17:26.910Z",
  "executiveSummary": "A critical memory corruption vulnerability exists within the GIMP image manipulation program, specifically localized to its Seattle Filmworks file loader component.\nThe flaw manifests as a heap-based buffer overflow, allowing a remote attacker to write several kilobytes of attacker-controlled data beyond the boundaries of the intended memory buffer.\nSuccessful exploitation of this vulnerability leads to severe memory corruption, which can culminate in arbitrary code execution within the context of the user running the application, or alternatively cause a denial of service through application crashes.\nThe attack vector requires user interaction; the victim must be successfully tricked into opening a specially crafted Seattle Filmworks file using the vulnerable software.\nGiven the potential for arbitrary code execution upon processing untrusted file inputs, the risk implications are significant for systems utilizing the affected GIMP image loader.\nNo elevated privileges are required by the attacker prior to exploitation, provided the victim opens the malicious file with the vulnerable application.",
  "technicalDetails": "The vulnerability resides in the parsing logic of the Seattle Filmworks file loader module within the GIMP image manipulation program.\nThe root cause is an insufficient bounds check or incorrect integer calculation when allocating and writing to the heap buffer during the processing of image dimensions or metadata contained within the malicious file format.\nAttack flow begins when an attacker crafts a malicious Seattle Filmworks image file containing manipulated structural data designed to induce an over-allocation or miscalculation of the required heap buffer size.\nThe remote attacker delivers this specially crafted file to the target user via standard delivery mechanisms such as email, malicious web downloads, or file shares.\nUpon receiving the file, the victim initiates the GIMP application and attempts to open or import the malicious Seattle Filmworks file.\nThe vulnerable Seattle Filmworks file loader parses the structure and attempts to read or write image data into the dynamically allocated heap buffer.\nDue to the absence of proper validation on the incoming data streams, the parsing routine writes several kilobytes of controlled data past the allocated memory boundary, corrupting adjacent heap metadata and structures.\nThis out-of-bounds write primitive allows the overwriting of critical heap structures, function pointers, or application data.\nDepending on the exact memory layout and heap state, the resulting memory corruption leads directly to arbitrary code execution with the permissions of the targeted user, or triggers a segmentation fault resulting in a denial of service.\nThe vulnerability requires no authentication and can be exploited locally by processing the untrusted file, operating entirely within the attack surface exposed by file import functionalities."
}