A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices… (CVE-2026-97185)

CVE-2026-97185 describes a security flaw in the GIMP image editor's GIMPressionist plug-in. The vulnerability arises from improper validation of vector indices before writing into fixed-size arrays when processing specially crafted GIMPressionist preset files. This out-of-bounds write can corrupt memory, which may be exploited by an attacker who convinces a user to load a malicious preset file, potentially resulting in a crash or arbitrary code execution. The CVSS 3.1 base score is 7.8, indicating a medium severity with local attack vector, low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can cause memory corruption leading to application crashes or arbitrary code execution on the user's system. The attack requires local access and user interaction (loading a malicious preset file). The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted or suspicious GIMPressionist preset files to mitigate risk.