CVE-2026-97185

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

This issue requires a local user to load a crafted GIMPressionist preset. The out-of-bounds write can corrupt memory and may allow code execution in the user's context. It is distinct from CVE-2026-90947, which addressed a similar flaw in the Lighting Effects plug-in.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not load GIMPressionist preset files from untrusted sources.