CVE-2026-59089
Received Received - Intake

Integer Overflow in GIMP PlayStation TIM Loader

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: Red Hat, Inc.

Description
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-07
AI Q&A
2026-07-06
EPSS Evaluated
N/A
NVD
CVE-2026-59089
EUVD
EUVD-2026-41913

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnome gimp *
gnome gimp to 3.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in GIMP's PlayStation TIM loader, which handles PlayStation image files. It is caused by an integer overflow when calculating the size of the Color Look-Up Table (CLUT). Specifically, the multiplication of two 16-bit unsigned short integers, num_colors and num_cluts, can exceed the maximum integer limit, leading to undefined behavior.

When exploited by an attacker providing a specially crafted image file, this overflow causes the GIMP plug-in to abort unexpectedly.

This results in a denial of service condition where the affected component stops functioning properly.

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) condition in GIMP.

An attacker can exploit this by supplying a specially crafted PlayStation TIM image file that triggers the integer overflow, causing the plug-in to abort.

This can disrupt normal use of GIMP, potentially causing crashes or interruptions when processing certain image files.

Detection Guidance

This vulnerability affects the GIMP PlayStation TIM loader and results in the plug-in aborting due to an integer overflow when processing specially crafted image files.

Detection can involve monitoring for crashes or abnormal termination of the GIMP plug-in when opening PlayStation TIM image files.

Since the issue triggers undefined behavior sanitizer (UBSan), running GIMP with UBSan enabled or checking system logs for UBSan reports related to GIMP may help detect exploitation attempts.

There are no specific network commands or signatures provided for detection in the available resources.

Mitigation Strategies

To mitigate this vulnerability, avoid opening untrusted or specially crafted PlayStation TIM image files in GIMP.

Monitor for updates or patches from GIMP or your operating system vendor addressing this issue and apply them as soon as they become available.

Consider running GIMP with security features such as UBSan enabled to detect abnormal behavior early.

If possible, restrict user permissions to prevent unauthorized users from running vulnerable versions of GIMP.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart