CVE-2026-18308

GIMP's TIF file parser lacks validation of user-supplied data, causing an integer overflow before buffer allocation (CWE-190). Opening a malicious TIF file triggers RCE in the current process context; CVSS 7.8 HIGH. A patch commit is referenced in the ZDI advisory (ZDI-26-461).