CVE-2026-59087 is a heap buffer overflow vulnerability in the Seattle Filmworks file loader component of the GIMP image manipulation program included in Red Hat Enterprise Linux 6. The flaw allows a remote attacker to cause a heap overflow by convincing a user to open a maliciously crafted Seattle Filmworks file. This overflow enables writing several kilobytes of attacker-controlled data beyond the allocated memory buffer, leading to memory corruption. The corruption can result in arbitrary code execution or denial of service. The vulnerability has a CVSS v3.1 base score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Red Hat rates this flaw as Important and advises caution when opening .sfw files from untrusted sources. No official fix or patch status is provided in the advisory as of the publication date.

Successful exploitation can lead to memory corruption in the GIMP application, potentially allowing arbitrary code execution or causing a denial of service (application crash). The attack requires user interaction by opening a specially crafted Seattle Filmworks file, and the attack vector is local. The impact affects confidentiality, integrity, and availability of the affected application process.

Red Hat advises users to avoid opening Seattle Filmworks (.sfw) files from untrusted sources within the GIMP application to mitigate this vulnerability. No official patch or fix is currently confirmed. Users should exercise caution when handling unsolicited or suspicious files. Monitor the Red Hat advisory for updates regarding patch availability.