This vulnerability involves an out-of-bounds write (buffer overflow) in the file-seattle-filmworks plugin of GIMP on Red Hat Enterprise Linux 6. When a user opens a maliciously crafted Seattle Filmworks file, the plugin may crash, leading to denial of service and possible instability of the GIMP application. The CVSS 3.1 base score is 6.1, reflecting medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No known exploits in the wild have been reported. The vendor advisory does not currently specify a remediation or patch status.

Successful exploitation results in denial of service by crashing the vulnerable plugin and potentially affecting the stability of the GIMP application. There is no indication of confidentiality or data integrity impact. The attack requires local access and user interaction to open a crafted file.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40919 for current remediation guidance. Until a fix is available, avoid opening untrusted Seattle Filmworks files with GIMP on affected systems.