CVE-2026-40916
Gimp: gimp: denial of service due to stack buffer overflow in tim image loader
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gimp: gimp: denial of service due to stack buffer overflow in tim image loader
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
- Record
CVE-2026-40916- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-05
EUVDEUVD-2026-23022
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
- Record
EUVD-2026-23022- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-xcqw-9mv2-wqj3
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP...
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
- Record
GHSA-xcqw-9mv2-wqj3- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
- Record
CVE-2026-40916- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-40916
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
- Record
DEBIAN-CVE-2026-40916- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40916
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
- Record
UBUNTU-CVE-2026-40916- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:14 |
before 3.2.2-1, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 10 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-1 |
3.2.2-1 |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 |
None known |
gimpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 |
None known |
gimpUbuntu:25.10 |
All versions, plus listed versions 3.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-1 Show 5 moreShow less3.0.4-23.0.4-33.0.4-53.0.4-63.0.4-6.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40916 is a medium vulnerability (CVSS 5.0) in Gimp, published April 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in gimp 3.2.2-1.
References
access.redhat.com/security/cve/CVE-2026-40916
bugzilla.redhat.com/show_bug.cgi?id=2458745
nvd.nist.gov/vuln/detail/CVE-2026-40916
github.com/advisories/GHSA-xcqw-9mv2-wqj3
security-tracker.debian.org/tracker/CVE-2026-40916
ubuntu.com/security/CVE-2026-40916
cve.org/CVERecord?id=CVE-2026-40916
gitlab.gnome.org/GNOME/gimp/-/issues/16052