Log in Start free

Vulnerability · Published Jul 6, 2026 · Assigned by redhat

CVE-2026-59089Gimp: gimp: denial of service via integer overflow in playstation tim loader

Medium 5.5

In plain English

A medium-severity integer overflow in gimp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 77.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14gimp3.2.6-1DEBIAN-CVE-2026-59089
Ubuntu:25.10gimpno fix listedUBUNTU-CVE-2026-59089
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-59089
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-59089

Affected products (as reported)

VendorProductVersions
gimp 3.2.6
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References