CVE-2026-90947

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

This vulnerability is rated as having Important impact because successful exploitation can allow arbitrary code execution within the privileges of the local desktop user, despite requiring explicit user interaction to open a malicious preset file. GIMP is an interactive graphical editing tool rather than an automated network service, which confines the attack surface to desktop sessions where untrusted lighting presets are loaded. Default Red Hat Enterprise Linux server environments are not exposed unless optional workstation packages and graphical desktop environments are explicitly installed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.