CVE-2026-2046 is a heap-based buffer overflow vulnerability in the LBM file parser of GIMP. The flaw is due to insufficient validation of the length of user-supplied data before copying it into a heap buffer, which can lead to arbitrary code execution in the context of the current process. Exploitation requires user interaction, such as opening a crafted malicious LBM file or visiting a malicious page. The vulnerability has a CVSS score of 7.8, indicating high severity. GIMP has issued an official patch to fix this vulnerability, as documented in their GitLab commit b4d41182dde4a1f98431b4d5b749a5a18bed0ab3.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the user running GIMP. This can lead to full compromise of the affected system or user environment. The vulnerability requires user interaction, limiting automatic exploitation. The CVSS vector indicates high impact on confidentiality, integrity, and availability.

An official patch has been released by GIMP to correct this vulnerability. Users and administrators should apply the update from the GIMP GitLab repository (commit b4d41182dde4a1f98431b4d5b749a5a18bed0ab3) or through their standard update channels to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.