CVE-2026-90947 — Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file
A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can …
Published: 2026-09-14 · CVSS: 7.8 · CVSS 3.1
A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7