CVE-2026-59087
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.
Key facts
- CVSS score
- 7.8 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-787
- EPSS score
- 0.5% (41th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2026-55165)
- Published
- August 10, 2026
- NVD last modified
- August 24, 2026
- Status
- Analyzed
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2026-55165 in the EU Vulnerability Database. Last updated in EUVD on August 24, 2026.
View on the EU Vulnerability DatabaseAffected products
- gimp / gimp
- redhat / enterprise linux
- redhat / enterprise linux
- redhat / enterprise linux
Certified products that may be affected
31 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
- Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
- Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
- Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
- Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
See all 31 in the Security Certifications Explorer.
References
- https://access.redhat.com/security/cve/CVE-2026-59087(Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2496576(Issue Tracking, Vendor Advisory)
- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16491(Exploit, Mitigation, Vendor Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain