What’s Vulnerable › Vulnerabilities

CVE-2026-79902: Gimp: stack vla size underflow denial of service in seattle

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-09-01
• Weakness: CWE-190

Description

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.

Affected products

• GIMP: through 3.3.1

References

• https://access.redhat.com/security/cve/CVE-2026-79902
• https://bugzilla.redhat.com/show_bug.cgi?id=2523512
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16582
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16582

Get alerted when CVE-2026-79902 or the next vulnerability affects your stack