CVE-2026-58387

A flaw was found in GIMP's Seattle FilmWorks SFW94A loader. In loadimage, photodate is allocated based on an unvalidated metadata separator offset and can become a 1-byte buffer before fread writes the full metadata span into it. This could lead to heap memory corruption, potentially resulting in...