Description

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-26T14:17:16.430Z",
  "pubdate": "2026-08-26T14:17:16.430Z",
  "executiveSummary": "The Seattle FilmWorks (SFW) plugin within GIMP is susceptible to a critical memory management vulnerability characterized by an unbounded stack-based Variable-Length Array (VLA) allocation. This flaw arises from the lack of sufficient integer overflow validation during the processing of malformed image files.\nThe vulnerability allows an unauthenticated, remote attacker to trigger a denial-of-service (DoS) condition by providing a specially crafted SFW image file. Upon processing the malicious payload, the application experiences an uncontrolled stack allocation, leading to an immediate crash. This security defect poses a significant availability risk to end-users and organizations utilizing GIMP to process untrusted graphics content. Exploitation does not require prior authentication or elevated privileges, as the impact is realized through standard image ingestion workflows.",
  "technicalDetails": "The root cause of the vulnerability resides in the implementation of the Seattle FilmWorks (SFW) image parsing logic within the GIMP plugin suite. During the decoding phase, the plugin fails to perform input validation on critical metadata fields within the SFW file header that dictate the size requirements for internal memory structures.\nSpecifically, the plugin employs a Variable-Length Array (VLA) declaration to allocate memory directly on the stack to accommodate image data structures. Because the code lacks integer overflow checks or bounds verification on the user-supplied dimensions, an attacker can supply a carefully crafted SFW file containing header values that lead to an arithmetic overflow when calculating the required allocation size. This manipulation causes the stack pointer to move unexpectedly or results in a massive, invalid memory allocation request.\nThe exploitation flow initiates when a victim opens or previews an image file processed by the vulnerable plugin. The parser reads the malicious header data, performs an insecure calculation, and attempts to reserve stack space based on the attacker-controlled integer value. This operation exceeds the available stack memory boundaries, resulting in a stack exhaustion event or memory corruption. The operating system's memory protection mechanisms typically respond to this uncontrolled memory access by terminating the GIMP process, thereby forcing an application crash.\nThis vulnerability is particularly concerning because the parsing logic executes in the context of the user running the GIMP application. Since the plugin processes the file automatically upon selection or preview, the attack vector is effectively triggered through standard user interaction with a malicious file. There are no authentication or authorization hurdles for an attacker, as the vulnerability is inherent to the parsing engine's lack of defensive programming against malformed inputs. Post-exploitation, the primary impact is total service disruption; however, the uncontrolled nature of stack-based allocations may theoretically present further avenues for memory corruption if the allocation logic can be manipulated to overwrite adjacent stack memory, although the reported outcome remains constrained to a denial of service."
}