CVE-2026-59088

EUVD-2026-55262

10.08.2026, 12:17

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 28.34%

Affected Products (NVD)

Vendor	Product	Version
gimp	gimp	3.2.4
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

gimp

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	3.2.6-1 fixed
trixie	3.0.4-3+deb13u10 fixed
trixie (security)	3.0.4-3+deb13u10 fixed

Ubuntu Releases

Ubuntu Product

Codename

gimp

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

gimp

suse enterprise desktop 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise sap 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise server 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise workstation 15 SP7	2.10.30-150400.3.74.1 fixed

gimp-devel

suse enterprise desktop 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise sap 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise server 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise workstation 15 SP7	2.10.30-150400.3.74.1 fixed

gimp-lang

suse enterprise desktop 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise sap 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise server 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise workstation 15 SP7	2.10.30-150400.3.74.1 fixed

libgimp-2_0-0

suse enterprise desktop 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise sap 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise server 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise workstation 15 SP7	2.10.30-150400.3.74.1 fixed

libgimpui-2_0-0

suse enterprise desktop 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise sap 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise server 15 SP7	2.10.30-150400.3.74.1 fixed
suse enterprise workstation 15 SP7	2.10.30-150400.3.74.1 fixed

Known Exploits!

https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492

Common Weakness Enumeration

CWE-190 - Integer Overflow or Wraparound
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Vulnerability Media Exposure

[GERMAN] GIMP: Mehrere Schwachstellen
Ein lokaler Angreifer kann mehrere Schwachstellen in GIMP ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
Published: 2026-08-10T22:00:00+00:00

References

https://access.redhat.com/security/cve/CVE-2026-59088

https://bugzilla.redhat.com/show_bug.cgi?id=2496582

https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492