CVE-2026-18302

A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the TIF file parsing component allows remote attackers to execute arbitrary code. Successful exploitation requires user interaction, where a target must open a malicious TIF file. An attacker can leverage this to execute code in the context of the current process.

This vulnerability is rated as an Important severity because opening a maliciously crafted image file can lead to arbitrary code execution with the privileges of the active user session. In Red Hat Enterprise Linux, GIMP is an interactive graphical application typically used in workstation or desktop environments, rather than an automated service or background daemon. Because exploitation requires explicit user interaction to process untrusted files, systems lacking graphical desktop environments or where users do not handle external image assets remain largely insulated from this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should exercise caution and avoid opening TIF image files from untrusted or unknown sources. As a general security practice, only process files from trusted origins.