CVE-2026-59088
published 2026-08-10CVE-2026-59088: A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an…
PriorityP425medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.33%
25.1th percentile
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gimp | gimp | — | — |
| gimp | gimp | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gimp: GIMP: Denial of service via signed integer overflow in FLI file processing
vendor_redhat·2026-06-15·CVSS 5.5
CVE-2026-59088 [MEDIUM] CWE-190 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing
gimp: GIMP: Denial of service via signed integer overflow in FLI file processing
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.
Statement: This Moderate impact flaw in GIMP's FLI file processing plugin can lead to a denial of service. The vulnerability requires user interaction, as an attacker must convince a local user to open a specially crafted FLI image file
GHSA
A flaw was found in GIMP.
ghsa_unreviewed·2026-08-10
CVE-2026-59088 [MEDIUM] CWE-190 A flaw was found in GIMP.
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59088 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing [fedora-all]
bugzilla·2026-08-10·CVSS 5.5
CVE-2026-59088 [MEDIUM] CVE-2026-59088 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing [fedora-all]
CVE-2026-59088 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492
fli_header.width and fli_header.height are gushort (uint16). The expression
fb = g_malloc (fli_header.width * fli_header.height);
ofb = g_malloc (fli_header.width * fli_header.height);
performs the multiplication after C integer promotion to int. When both values are 65535 the product 4,294,836,225 exceeds INT_MAX (2,147,483,647) → undefined behavior. UBSan detects this and the plug-in aborts.
Affected c
Bugzilla
CVE-2026-59088 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing
bugzilla·2026-07-02·CVSS 5.5
CVE-2026-59088 [MEDIUM] CVE-2026-59088 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing
CVE-2026-59088 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492
fli_header.width and fli_header.height are gushort (uint16). The expression
fb = g_malloc (fli_header.width * fli_header.height);
ofb = g_malloc (fli_header.width * fli_header.height);
performs the multiplication after C integer promotion to int. When both values are 65535 the product 4,294,836,225 exceeds INT_MAX (2,147,483,647) → undefined behavior. UBSan detects this and the plug-in aborts.
Affected code
/* plug-ins/file-fli/fli-gimp.c:541-546 */
image = gimp_image_new (fli_header.width, fli_header.height, GIMP_INDEXED);
fb = g_malloc (fli_header.width * fli_header.height);
ofb = g_malloc (fli_header.width * fli_header.height);
Fil
2026-08-10
Published