CVE-2026-18306

This CVE targets an integer overflow in GIMP's SGI image format parser. The vulnerability occurs when parsing SGI file headers — specifically in dimension and offset calculations where insufficient bounds validation allows overflows that corrupt memory beyond buffer boundaries. Triggering it requires a victim to open a crafted SGI file, giving it CVSS 7.8 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The user-interaction barrier is thinner than it appears: systematic fuzzing of image parsers has already solved the exploitation chain for attackers; the remaining requirement is just getting someone to open a file, which social engineering handles. The more significant exposure is GIMP's role as a format conversion hub. When GIMP processes an SGI file and exports to PNG, JPEG, or WebP, the overflow-corrupted data can propagate through the re-encoding pipeline into downstream systems — corrupted thumbnails, malformed exports, or poisoned intermediates in automated scripts. Treat this as a supply chain risk if GIMP lives in your asset processing pipeline. Examine whether your GIMP deployment runs in a privileged context (plugin architectures, export workflows calling system binaries, scripting extensions bridging to Python/Lisp). The CVSS metrics don't capture that

Reviewed through automated stages and approved by a human before publication.