CVE-2026-79902: Gimp: stack vla size underflow denial of service in seattle
Published Aug 26, 2026
·Updated
A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.
Affected Software
1 affected component
GIMP
Event History
Aug 26, 2026
CVE Published
via MITRE·01:34 PM
Data Sourced
via MITRE·01:34 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker do to trigger the issue?
An attacker must persuade a user to process a specially crafted SFW image file with GIMP's Seattle FilmWorks plugin. Exploitation requires local access and user interaction, but no privileges are required.
2
What is the practical impact?
Processing the crafted file can cause an unbounded stack allocation and crash the GIMP application. The reported impact is denial of service; no confidentiality or integrity impact is specified.