CVE-2026-59087 is a heap buffer overflow vulnerability in the Seattle Filmworks file loader component of the GIMP image manipulation program. The flaw arises from an out-of-bounds write (CWE-787) when the loader processes a specially crafted Seattle Filmworks file, allowing an attacker to write several kilobytes of controlled data beyond the intended memory buffer. This memory corruption can lead to arbitrary code execution or denial of service. Exploitation requires user interaction to open a malicious file. The vulnerability has a CVSS 3.1 base score of 7.8 (high severity) with local attack vector, low complexity, no privileges required, and user interaction needed. No official patch or fix is currently available according to the vendor advisory. The recommended mitigation is to avoid opening Seattle Filmworks files from untrusted sources.

Successful exploitation can result in memory corruption due to a heap overflow, potentially allowing an attacker to execute arbitrary code or cause a denial of service in the GIMP application. The attacker must trick a user into opening a malicious Seattle Filmworks file. The impact affects confidentiality, integrity, and availability at a high level within the application context.

There is no official patch or fix currently available for this vulnerability. Users should mitigate risk by avoiding opening Seattle Filmworks (.sfw) files from untrusted or suspicious sources within the GIMP application. Exercise caution when handling unsolicited files. Monitor vendor advisories for updates on patches or fixes.