CVE-2026-97185 is an out-of-bounds write vulnerability in the GIMPressionist plug-in of GIMP on Red Hat Enterprise Linux 10. The plug-in fails to properly validate vector indices before writing into fixed-size arrays when processing crafted GIMPressionist preset files. This can lead to memory corruption, potentially causing a crash or enabling code execution under the user's context. Exploitation requires a local user to convince a user to load a malicious preset file. This vulnerability is distinct from CVE-2026-90947, which affected a different GIMP plug-in. The CVSS 3.1 score is 7.8 (high severity) with local attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can corrupt memory and may allow arbitrary code execution in the context of the user who loads the malicious preset file. It can also cause denial of service through application crashes. The attack requires local access and user interaction to load a crafted preset file.

Red Hat's advisory recommends not loading GIMPressionist preset files from untrusted sources. No official patch or fix status is provided in the advisory, so patch status is not yet confirmed — check the vendor advisory for current remediation guidance.