CVE-2026-59089
Gimp: gimp: denial of service via integer overflow in playstation tim loader
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gimp: gimp: denial of service via integer overflow in playstation tim loader
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
- Record
CVE-2026-59089- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-05
EUVDEUVD-2026-41913
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
- Record
EUVD-2026-41913- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-7v2w-74r7-8rq2
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image...
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
- Record
GHSA-7v2w-74r7-8rq2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
- Record
CVE-2026-59089- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-06
OSV
Gimp: gimp: denial of service via integer overflow in playstation tim loader
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
- Record
CVE-2026-59089- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-59089
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
- Record
DEBIAN-CVE-2026-59089- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2026-3095
gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.
Security Fix(es):
A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.(CVE-2026-58379)
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.(CVE-2026-59089)
- Record
OESA-2026-3095- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-59089
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
- Record
UBUNTU-CVE-2026-59089- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0578 No score
Updated gimp packages fix security vulnerabilities
This update to v. 3.2.8 fixes several security issues.
- Record
MGASA-2026-0578- Updated
- 2026-11-07
OSVopenSUSE-SU-2026:11264-1 No score
gimp-3.2.4-2.1 on GA media
These are all security issues fixed in the gimp-3.2.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11264-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:14 |
before 3.2.6-1, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 14 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-3 |
3.2.6-1 |
gimpMageia:10 From an advisory covering 28 CVEs |
before 3.2.8-1.mga10 | 3.2.8-1.mga10 |
gimpopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs |
before 3.2.4-3.oe2403sp4 | 3.2.4-3.oe2403sp4 |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 |
None known |
gimpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 |
None known |
gimpUbuntu:25.10 |
All versions, plus listed versions 3.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-1 Show 5 moreShow less3.0.4-23.0.4-33.0.4-53.0.4-63.0.4-6.1 |
None known |
gimpUbuntu:26.10 |
All versions, plus listed versions 3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 |
None known |
gimpUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 |
None known |
gimpopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.2.4-2.1 | 3.2.4-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59089 is a medium vulnerability (CVSS 5.5) in Gimp, published July 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in gimp 3.2.6-1.
References
access.redhat.com/security/cve/CVE-2026-59089
bugzilla.redhat.com/show_bug.cgi?id=2496583
gitlab.gnome.org/GNOME/gimp/-/work_items/16493
nvd.nist.gov/vuln/detail/CVE-2026-59089
github.com/advisories/GHSA-7v2w-74r7-8rq2
Show 18 moreShow less
security-tracker.debian.org/tracker/CVE-2026-59089
advisories.mageia.org/MGASA-2026-0578.html
bugs.mageia.org/show_bug.cgi?id=36194
lists.opensuse.org/archives/list/[email protected]/message/LUXP5VNBOZ64AC65YKLO3MBCA4XXR3YS
lists.debian.org/debian-security-announce/2026/msg00381.html
gimp.org/news/2026/09/10/gimp-3-2-6-released
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3095
ubuntu.com/security/CVE-2026-59089
cve.org/CVERecord?id=CVE-2026-59089
suse.com/security/cve/CVE-2026-58379