CVE-2026-59089
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A flaw was found in GIMP where the PlayStation TIM loader incorrectly calculates the CLUT size due to an integer overflow. Multiplying two 16-bit unsigned short integers (num_colors and num_cluts) can exceed the maximum integer limit, leading to undefined behavior. An attacker can exploit this by providing a specially crafted image file, causing the plug-in to abort and resulting in a denial of service.
Risk Assessment
The risk is a remote denial of service triggered by opening a malicious PlayStation TIM image file. This can disrupt GIMP operations and impact user productivity.
Recommendation
Immediately update GIMP to the latest version containing the fix for CVE-2026-59089. Until updated, avoid opening PlayStation TIM files from untrusted sources.
Other vulnerabilities in GIMP
See all- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-97185High
In GIMP, when processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- CVE-2026-96546Low
GIMP's uncompressed DDS image loader has a one-byte out-of-bounds heap read flaw. After processing the final pixel, the file-dds plug-in performs an unconditional one-byte look-ahead, which may cause a crash if the byte is inaccessible.
- CVE-2026-96545Medium
An out-of-bounds heap read flaw exists in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
- CVE-2026-92248High
A heap-based buffer overflow vulnerability exists in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD file, an integer overflow occurs during multiplication of values from an embedded JPEG header, leading to an undersized heap allocation and a heap-based buffer overflow during image decoding.
Original NVD description (English source)
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS