CVE-2026-59089: Gimp: gimp: denial of service via integer overflow in playstation tim loader
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying numcolors and numcluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
Other sources
https://gitlab.gnome.org/GNOME/gimp/-/workitems/16493
PlayStation TIM loader computes CLUT size as guint clutsize = numcolors numcluts; Both operands are gushort. After integer promotion, 65535 65535 = 4,294,836,225 > INTMAX → undefined behavior. UBSan-detected; plug-in aborts.
File: plug-ins/common/file-tim.c:486 Version: GIMP 3.2.4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GIMPto a version that resolves this vulnerability.Fixed in 3.2.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59089?
CVE-2026-59089 has a medium severity rating of 5.5.
How do I fix CVE-2026-59089?
To fix CVE-2026-59089, update GIMP to the latest version that addresses the integer overflow issue.
What types of systems are affected by CVE-2026-59089?
CVE-2026-59089 affects Red Hat Enterprise Linux and GIMP versions running in GNOME environments.
What is the risk associated with CVE-2026-59089?
CVE-2026-59089 poses a risk of denial of service due to an integer overflow in the PlayStation TIM loader.
Is data integrity compromised by CVE-2026-59089?
CVE-2026-59089 does not compromise data integrity since it does not lead to data corruption or unauthorized data access.