CVE-2026-18301

For CVE-2026-18301 in GIMP, the CVSS 7.8 and EPSS 0.00464 split is telling you something important: the technical severity is real—an integer overflow in PSD file parsing can lead to RCE—but the actual exploitation risk for most organizations is genuinely low. Not zero, but low. This is a case where the CVSS measures what the vulnerability could do if exploited, while EPSS measures how likely exploitation actually is. For GIMP, the answer is: not very likely, because exploiting this requires a user to deliberately open a malicious PSD file. That's a meaningful barrier compared to network-exploitable vulnerabilities. What you should do: treat this as a regular patch cycle item, not an emergency. The priority should be higher if GIMP runs on systems that process untrusted files automatically—anywhere a file lands on a GIMP-enabled machine without user interaction elevates this significantly. Also consider the blast radius beyond the workstation: creative workflows typically involve NAS storage, cloud sync (Creative Cloud, Dropbox), version control, and handoff to downstream users. A compromised workstation can contaminate shared storage, and those files may propagate before you even know there's a problem. The practical risk management move is straightforward: patch GIMP on machines that handle untrusted input on a normal cadence (within 30 days), but don't treat this as a critical emergency unless you have automated file processing pipelines running GIMP. The coordinated disclosure (ZDI-CAN-29395) means a patch exists and threat actors were aware, but the low EPSS suggests they found better targets. That could change if the same bug class appears in more widely-deployed software—watch for that pattern. One operational concern: low EPSS scores can become self-fulfilling. If your process deprioritizes based on EPSS, this vulnerability sits unpatched longer, extending your exposure window regardless of what the score predicted. For creative software with file parsers, that temporal debt compounds because these applications tend to handle files that live in shared storage and version control. The unpatched version doesn't just stay on one machine—it stays in your data pipeline.

Reviewed through automated stages and approved by a human before publication.