CVE-2026-59089
published 2026-07-06CVE-2026-59089: A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up…
PriorityP424medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.21%
10.9th percentile
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gimp | gimp | — | — |
| gimp | gimp | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in GIMP.
ghsa_unreviewed·2026-07-06
CVE-2026-59089 [MEDIUM] CWE-190 A flaw was found in GIMP.
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
VulDB
GIMP TIM Loader integer overflow
vuldb·2026-07-06·CVSS 5.5
CVE-2026-59089 [MEDIUM] GIMP TIM Loader integer overflow
A vulnerability categorized as problematic has been discovered in GIMP. This affects an unknown part of the component TIM Loader. Executing a manipulation can lead to integer overflow.
This vulnerability is registered as CVE-2026-59089. It is possible to launch the attack remotely. No exploit is available.
Red Hat
gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader
vendor_redhat·2026-06-15·CVSS 5.5
CVE-2026-59089 [MEDIUM] CWE-190 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader
gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
Statement: Conditions for Exploitation: Successful exploitation requires user interaction. An attacker must trick a user into manually opening a specially crafted, malicious PlayStat
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59089 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader [fedora-all]
bugzilla·2026-07-06·CVSS 5.5
CVE-2026-59089 [MEDIUM] CVE-2026-59089 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader [fedora-all]
CVE-2026-59089 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493
PlayStation TIM loader computes CLUT size as
guint clut_size = num_colors * num_cluts;
Both operands are gushort. After integer promotion, 65535 * 65535 = 4,294,836,225 > INT_MAX → undefined behavior. UBSan-detected; plug-in aborts.
File: plug-ins/common/file-tim.c:486
Version: GIMP 3.2.4
Bugzilla
CVE-2026-59089 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader
bugzilla·2026-07-02·CVSS 5.5
CVE-2026-59089 [MEDIUM] CVE-2026-59089 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader
CVE-2026-59089 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493
PlayStation TIM loader computes CLUT size as
guint clut_size = num_colors * num_cluts;
Both operands are gushort. After integer promotion, 65535 * 65535 = 4,294,836,225 > INT_MAX → undefined behavior. UBSan-detected; plug-in aborts.
File: plug-ins/common/file-tim.c:486
Version: GIMP 3.2.4
2026-07-06
Published