The CVSS 7.8 rating for CVE-2026-18305 (integer overflow in GIMP's TIFF parser) is technically accurate, but the EPSS score of 0.00464 badly miscalibrates real-world risk for the population that actually uses GIMP. The vulnerability stems from malicious dimension or offset values wrapping during buffer size calculation, resulting in undersized heap allocations that subsequent writes overflow. That mechanism is well-understood. What the standard metrics miss is the threat model.
GIMP's user base — designers, illustrators, print professionals — opens files from diverse external sources as routine daily workflow. The 'user interaction required' encoded in CVSS assumes users exercise caution with untrusted files. In creative workflows, that assumption is dead. A malicious TIFF arriving as a client project file, stock asset, or collaborator deliverable is indistinguishable from legitimate input, and victims open these files without hesitation. You don't need a phishing campaign; you need a file disguised as legitimate work product, which happens thousands of times daily in design agencies.
The attack surface extends beyond the individual GIMP user. A weaponized TIFF enters a creative supply chain: the designer opens it, exports conversions to PNG, PDF, and web formats, sends files to print vendors, uploads assets to DAM systems, and archives project files. Each touchpoint — ImageMagick, Ghostscript, content management pipelines — is a separate blast radius node. The vulnerability doesn't detonate once; it propagates through the entire pipeline.
The ZDI-CAN-29406 designation is the underused signal. This went through Zero Day Initiative disclosure with a vendor patch window before public assignment. The year-2026 CVE assignment is anomalous and suggests either documentation lag or the vendor held the patch through multiple release cycles. If the latter, the vulnerable code path existed in shipped GIMP releases for potentially years — meaning the retrospective exploitation window is far larger than the CVE record implies. The silence on whether this is a surgical fix versus broader TIFF parser hardening is itself directional: vendors scope narrowly when patching specific points, while explicit hardening announcements are harder to hide. Expect follow-on patches in other GIMP format handlers (PSD, XCF, JPEG2000, WebP) within the next 60-90 days if this was truly isolated.
EPSS measures mass-exploitation probability, not targeted supply chain injection. Recalibrating the score for creative workflows would help, but the deeper problem is fix-to-disclosure lag. If this patch sat in GIMP releases before the CVE was assigned, creative supply chains were exposed to a patched-but-unannounced flaw — a window where the exploitability signal was artificially deflated because the bug wasn't public knowledge.
Prioritize these actions: verify GIMP versions across creative workstations and ensure the patch is actually deployed (most design shops lack centralized update management); treat this as evidence that other GIMP format handlers likely share the same vulnerable integer arithmetic patterns and flag them for review; and reconstruct your asset intake pipeline to treat incoming TIFF files as untrusted input regardless of source reputation. The CVSS severity is accurate. The EPSS probability is not the relevant metric for this ecosystem.