CVE-2026-59087 is a heap buffer overflow vulnerability in GIMP's Seattle Filmworks file loader. The flaw arises because the file loader uses an attacker-controlled length value in an undersized memory allocation, leading to out-of-bounds write operations (CWE-787). This memory corruption can result in arbitrary code execution or denial of service when a user opens a specially crafted Seattle Filmworks file. The vulnerability affects GIMP version 3.2.4-4.1 on openSUSE Tumbleweed GA media and related packages. The vulnerability has a CVSS v3.1 base score of approximately 7.8 (Important/Medium severity) with local attack vector and user interaction required. Red Hat's advisory confirms the vulnerability and recommends avoiding untrusted .sfw files as mitigation.

The vulnerability allows an attacker to cause memory corruption via a heap buffer overflow, potentially leading to arbitrary code execution or denial of service within the GIMP application context. Exploitation requires a user to open a malicious Seattle Filmworks file, which can trigger the overflow. The impact includes high confidentiality, integrity, and availability impacts as per CVSS metrics.

Users should avoid opening Seattle Filmworks (.sfw) files from untrusted or suspicious sources within the GIMP application. No official patch or fix is explicitly stated in the provided advisory content; therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Exercising caution with unsolicited files is recommended as a mitigation measure.