CVE-2026-18308 is an integer overflow vulnerability in GIMP's TIF file parser. The vulnerability occurs due to insufficient validation of user input, which can cause an integer overflow prior to buffer allocation. This can be exploited by a remote attacker who convinces a user to open a crafted malicious TIF file, resulting in arbitrary code execution within the context of the GIMP process. The vulnerability has a CVSS score of 7.8 and was publicly disclosed by the Zero Day Initiative on July 29, 2026. GIMP has released a patch to fix this issue.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the user running GIMP. This can lead to complete compromise of the affected system or user environment. The attack requires user interaction, such as opening a malicious TIF file, but no privileges or authentication are needed to initiate the attack.

GIMP has issued an official update that corrects this vulnerability. Users and administrators should apply the update promptly to mitigate the risk. Since this is a client-side vulnerability requiring user interaction, avoiding opening untrusted TIF files also reduces exposure.