CVE-2026-40915
Integer Overflow and Heap Buffer Overflow in GIMP FITS Loader
Publication date: 2026-04-15
Last updated on: 2026-04-28
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| gimp | gimp | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-40915 is a security flaw in GIMP's FITS image loader. It involves an integer overflow triggered by a specially crafted FITS file, which causes a zero-byte memory allocation on the heap.
This zero-byte allocation is then exploited to cause a heap buffer overflow when processing pixel data, potentially allowing a remote attacker to cause a denial of service or execute arbitrary code.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to a denial of service (DoS), causing the GIMP application to crash or become unresponsive.
More severely, it could allow an attacker to execute arbitrary code remotely, potentially compromising the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update GIMP to a version where the integer overflow in the FITS image loader is fixed.
Avoid opening untrusted or specially crafted FITS files with GIMP until a patch is applied.