Skip to content
OpenAdvisories
High · 7.8 CVE-2026-59087 EUVD-2026-55165GHSA-hh4m-xc2h-qj94

Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation

Published Aug 10, 2026 · Updated Nov 4, 2026 · Assigned by redhat

Description

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.

Affected products

VendorProductAffectedFixed
— gimp 3.2.4 —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 gimp 3.2.6-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 gimp No fix yet —
Ubuntu 26.04 LTS gimp No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS gimp No fix yet —
Ubuntu Pro 22.04 LTS gimp No fix yet —
Ubuntu Pro 20.04 LTS gimp No fix yet —
Ubuntu Pro 18.04 LTS gimp No fix yet —
Ubuntu Pro 16.04 LTS gimp No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed gimp 3.2.4-4.1 openSUSE-SU-2026:11547-1

Advisories 2

References