CVE-2026-79902

🔶 medium

Summary

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.

CVSS Score

5.5

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-08-26

First Seen: 2026-08-28

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 31.3% of all 360,548 vulnerabilities in our database.

#247,531

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 26, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Red Hat would like to thank Zhixi "Jace" Sun for reporting this issue.

SSVC data provided by CISA

Last Modified 2026-09-01

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-190

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
gimp	gimp	Affected	< 3.3.1

🔗 References 3

https://access.redhat.com/security/cve/CVE-2026-79902

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2523512

Permissions Required

https://gitlab.gnome.org/GNOME/gimp/-/work_items/16582

Issue Tracking Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-82324	🔶 medium	6.1	0.2	A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the...	2026-08-28
CVE-2026-82328	🔶 medium	6.1	0.2	A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not...	2026-08-28
CVE-2026-82330	🔶 medium	6.1	0.2	A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed)...	2026-08-28
CVE-2026-82343	🔶 medium	6.1	0.2	A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not...	2026-08-28
CVE-2026-80101	🔶 medium	4.4	0.2	A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validate...	2026-08-25
CVE-2026-78465	⚠️ high	7.0	0.2	A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plu...	2026-08-24

These CVEs affect the same products