CVE-2026-59087: gimp Out-of-bounds Write
Vulnerability summary
CVE-2026-59087 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in gimp. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 10-08-2026PublishedVulnerability first disclosed.
- 24-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.01 pp
From 0.48% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- gimp< 3.2.6-1
Gimp1 product
- gimp3.2.4
Redhat1 product
- enterprise_linuxEOL7.0 | 8.0 | 9.0
Ubuntu1 product
- gimpAll versions (No fix recorded)
4 vendors · 4 products
