CVE-2026-40915
Received Received - Intake
Integer Overflow and Heap Buffer Overflow in GIMP FITS Loader

Publication date: 2026-04-15

Last updated on: 2026-04-28

Assigner: Red Hat, Inc.

Description
A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-15
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-04-16
EPSS Evaluated
2026-06-14
NVD
CVE-2026-40915
EUVD
EUVD-2026-23020
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
redhat enterprise_linux 7.0
redhat enterprise_linux 6.0
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
gimp gimp *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-40915 is a security flaw in GIMP's FITS image loader. It involves an integer overflow triggered by a specially crafted FITS file, which causes a zero-byte memory allocation on the heap.

This zero-byte allocation is then exploited to cause a heap buffer overflow when processing pixel data, potentially allowing a remote attacker to cause a denial of service or execute arbitrary code.

Impact Analysis

Exploitation of this vulnerability can lead to a denial of service (DoS), causing the GIMP application to crash or become unresponsive.

More severely, it could allow an attacker to execute arbitrary code remotely, potentially compromising the affected system.

Mitigation Strategies

To mitigate this vulnerability, you should update GIMP to a version where the integer overflow in the FITS image loader is fixed.

Avoid opening untrusted or specially crafted FITS files with GIMP until a patch is applied.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart