CVE-2026-59087 is a high severity heap overflow in GIMP's Seattle Filmworks file loader. Opening a crafted file can write kilobytes of controlled data past a buffer, causing memory corruption, a crash or possibly code execution. No fixed version is confirmed, so check the Red Hat and GIMP advisories.
What's affected
- Product: GIMP, the image manipulation program, and the Red Hat Enterprise Linux packages of it.
- Affected versions: the record does not give a range. Check the Red Hat CVE page and the GIMP issue for affected and fixed builds.
- Fixed: not confirmed in the record or in the pages fetched. Treat the advisory as the source of truth for the fixed version.
- Trigger: a user opens a crafted image file. The record says the overflow writes several kilobytes of controlled data beyond the buffer.
How to check if you're exposed
Find the GIMP build you run and where it came from.
gimp --version
rpm -q gimp
On other systems use the package manager of your distribution. Then compare against the fixed versions listed on the Red Hat CVE page once an erratum is published. At the time of the fetch the Red Hat Bugzilla entry showed status NEW, so a fix may not be released yet.
Also consider who opens files in GIMP on your systems. Design workstations, build servers that batch convert images, and image processing pipelines that call GIMP in scripts are the places where untrusted files arrive.
What to do now
- Check the Red Hat CVE page and the GIMP issue for a fixed version, and install it when it is available.
- Until then, avoid opening image files from untrusted sources in GIMP, especially the formats named in the record.
- Do not run GIMP in automated pipelines on untrusted uploads. If you must, use a sandbox with no network and no access to secrets.
- Run GIMP as an unprivileged user.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). The Red Hat Bugzilla title says the file-seattle-filmworks load path uses fread to write an attacker controlled length into an undersized allocation. The loader trusts a length from the file, and the allocation does not match it.
An old, rarely used format is a typical place for this bug. Few people open Seattle Filmworks files, yet the loader ships and runs for anyone who opens one. The record says the result can be memory corruption, which can lead to arbitrary code execution or a denial of service. It scores 7.8 (High), with local access and user interaction needed, which means the victim must open the file. The record does not mark it as exploited in the wild.
Quick check
Does someone have to open the file?
Yes. The vector requires user interaction: the record describes tricking a user into opening a specially crafted Seattle Filmworks file.
Sources
Last reviewed: 18 October 2026.
