CVE-2026-79902 Overview
A flaw exists in the Seattle FilmWorks (SFW) plugin bundled with GIMP. The plugin processes attacker-supplied SFW image files and allocates a Variable-Length Array (VLA) on the stack using untrusted size fields. The code performs no integer overflow checks before the allocation, producing an unbounded stack allocation. Opening a crafted SFW file crashes GIMP, resulting in a local denial of service. The weakness is classified as Integer Overflow or Wraparound [CWE-190]. Exploitation requires user interaction to open the malicious file. Confidentiality and integrity are not impacted, but availability is.
Critical Impact
A crafted SFW image file triggers an unbounded stack allocation in the GIMP Seattle FilmWorks plugin, crashing the application and denying service to the local user.
Affected Products
- GIMP (GNU Image Manipulation Program) with the Seattle FilmWorks plugin enabled
- Red Hat distributions shipping the affected GIMP SFW plugin
- Downstream Linux distributions packaging the vulnerable plugin
Discovery Timeline
- 2026-08-26 - CVE-2026-79902 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79902
Vulnerability Analysis
The Seattle FilmWorks plugin parses SFW image files and derives allocation sizes from header fields inside the file. The plugin then declares a Variable-Length Array on the stack using those derived sizes. Because the arithmetic that computes the allocation size runs without overflow checks, a malformed file can force the computed size to wrap or to grow beyond the available stack region. The resulting VLA allocation exceeds stack limits and terminates the GIMP process.
The issue is local and requires a user to open a specially crafted SFW file in GIMP. There is no memory corruption path documented in the advisory, and the impact is limited to availability. No code execution vector has been reported. The vulnerability affects only the SFW loader code path, so users who do not open SFW files are not exposed at runtime.
Root Cause
The root cause is missing validation on size fields read from an untrusted file, combined with the use of a stack-allocated VLA sized by those fields. Standard integer overflow and upper-bound checks are absent before the allocation.
Attack Vector
An attacker delivers a crafted SFW file through email, download, or shared storage. The victim opens the file in GIMP. The plugin computes an attacker-controlled VLA size and crashes the process during allocation. No network exposure exists, and no elevated privileges are gained.
No verified proof-of-concept code has been published. See the Red Hat CVE-2026-79902 Advisory and the GNOME GIMP Work Item #16582 for upstream technical detail.
Detection Methods for CVE-2026-79902
Indicators of Compromise
- Unexpected GIMP process termination shortly after a user opens a file with an .sfw extension or an SFW magic header.
- Core dumps or crash reports referencing the Seattle FilmWorks plugin loader.
- Delivery of .sfw attachments or downloads from untrusted sources in email or web proxy logs.
Detection Strategies
- Alert on GIMP process crashes correlated with recent file-open events for SFW-format inputs.
- Inspect endpoint telemetry for .sfw files written to user download or temp directories from external origins.
- Flag repeated GIMP crashes on a single host as a possible targeted denial-of-service attempt.
Monitoring Recommendations
- Monitor application crash logs and systemd-coredump entries for the GIMP binary.
- Track file-download and email-attachment events for uncommon image formats such as SFW.
- Correlate user file-open activity with process-exit events to identify parser-triggered crashes.
How to Mitigate CVE-2026-79902
Immediate Actions Required
- Apply vendor updates for GIMP as soon as your distribution publishes a fixed package.
- Instruct users not to open SFW files received from untrusted sources.
- Remove or disable the Seattle FilmWorks plugin on systems that do not require SFW support.
Patch Information
At publication, upstream tracking is available through GNOME GIMP Work Item #16582 and Red Hat Bug Report #2523512. Consult your distribution's security advisories for fixed package versions, and update GIMP through the standard package manager once patches are released.
Workarounds
- Delete or move the SFW plugin binary from the GIMP plug-ins directory to prevent the loader from executing.
- Block .sfw file delivery at the email gateway and web proxy until patched builds are deployed.
- Restrict GIMP usage to trusted image formats through user policy and file-association changes.
# Example: locate and disable the Seattle FilmWorks plugin on Linux
find /usr/lib*/gimp -type f -iname 'file-sfw*' -print
sudo chmod a-x /usr/lib64/gimp/2.0/plug-ins/file-sfw/file-sfw
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
