CVE-2026-58387

A flaw was found in GIMP's Seattle FilmWorks (SFW94A) loader. In load_image(), photo_date is allocated based on an unvalidated metadata separator offset and can become a 1-byte buffer before fread() writes the full metadata span into it. This could lead to heap memory corruption, potentially resulting in denial of service or arbitrary code execution.

A flaw was found in GIMP's Seattle FilmWorks (SFW94A) loader. A malformed metadata record can cause load_image() to allocate an undersized heap buffer for photo_date before reading a larger metadata span into it. Successful exploitation requires a user to open a specially crafted SFW file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.