Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

GIMP crashes when opening a malicious image file

CVE-2026-40916 · published 6 months ago
Summary

A security issue in GIMP's image loader can cause the program to crash if it's opened with a specially crafted image file. This could prevent you from using GIMP on your computer. To stay safe, keep your GIMP software up to date with the latest security patches.

What to do
  • Update debian gimp to version 3.2.2-1.
Affected software
Ecosystem VendorProductAffected versions
– gimp gimp All versions
cpe:2.3:a:gimp:gimp:-:*:*:*:*:*:*:*
– redhat enterprise_linux 6.0
7.0
8.0
9.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Debian:14 debian gimp < 3.2.2-1
Fix: upgrade to 3.2.2-1
– red hat red hat enterprise linux 6 All versions
– red hat red hat enterprise linux 7 All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 9 All versions
Original advisory text
Gimp: gimp: denial of service due to stack buffer overflow in tim image loader
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published15 Apr 2026
Updated29 Oct 2026
First seen15 Apr 2026
Sources
CVE-2026-40916 · NVD
CVE-2026-40916 · MITRE
DEBIAN-CVE-2026-40916 · OSV
Track software like this
Free during beta