A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.
CVE-2026-79902
CVSS base score
5.5 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-190
Last modified
November 6, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
gimp gimp
References
- access.redhat.com Vendor Advisory
- bugzilla.redhat.com Permissions Required
- gitlab.gnome.org Issue Tracking, Mitigation, Vendor Advisory
- gitlab.gnome.org Issue Tracking, Mitigation, Vendor Advisory