CVE-2026-59087 is a heap buffer overflow vulnerability in the GIMP image manipulation program's Seattle Filmworks file loader. A remote attacker can exploit this by tricking a user into opening a maliciously crafted Seattle Filmworks file, causing a heap overflow that writes attacker-controlled data beyond the allocated memory buffer. This memory corruption can result in arbitrary code execution or denial of service. The vulnerability has a CVSS 3.1 base score of 7.8 with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The flaw is tracked under CWE-787 (Out-of-bounds Write).

Successful exploitation can lead to memory corruption in the GIMP application, potentially allowing an attacker to execute arbitrary code or cause a denial of service (application crash). The attack requires local user interaction by opening a crafted Seattle Filmworks file, limiting the attack vector to local or user-level scenarios.

Red Hat advises users to avoid opening Seattle Filmworks (.sfw) files from untrusted sources within the GIMP application. No official patch or fix has been confirmed yet; users should monitor the Red Hat advisory for updates. Exercising caution with untrusted files is the primary mitigation currently recommended.