Skip to main content

GIMP CVE-2026-40916

| EUVDEUVD-2026-23022 MEDIUM
Out-of-bounds Write (CWE-787)
2026-04-15 redhat GHSA-xcqw-9mv2-wqj3
5.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.0 MEDIUM
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.0 MEDIUM

Local attack, low privileges, user must open the file, only availability impact from the crash

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:R/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.1 LOW
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Red Hat
5.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 26, 2026 - 15:18 vuln.today
Patch released
Apr 19, 2026 - 08:30 nvd
Patch available
EUVD ID Assigned
Apr 15, 2026 - 19:45 euvd
EUVD-2026-23022
CVE Published
Apr 15, 2026 - 18:58 nvd
MEDIUM 5.0

DescriptionCVE.org

A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.

AnalysisAI

Denial of service in GIMP allows local attackers to crash the application by tricking a user into opening a malicious TIM image file. The vulnerability resides in the TIM image loader's 4BPP decoding path, where an unconditional stack buffer overflow occurs when processing a specially crafted file, with no impact on confidentiality or integrity. No active exploitation or public exploit is known, and a vendor patch is available.

Technical ContextAI

The flaw is in GIMP's built-in handling of the TIM (Timber) image format, specifically in the routine that decodes 4‑bits‑per‑pixel (4BPP) data. During decoding, a fixed‑size stack buffer is written to without proper bounds checking, leading to a classic CWE-787 Out-of-bounds Write. The affected component is GIMP as shipped with Red Hat Enterprise Linux 6, 7, 8, and 9 (CPE strings confirm the distribution channels, though the code is part of the GIMP application itself).

RemediationAI

Apply the vendor‑released patch through Red Hat's standard update channels. Exact fix versions are not stated in the advisory, but upgrading to the latest GIMP packages for your RHEL release will resolve the issue. As a temporary workaround, avoid opening untrusted TIM image files in GIMP, though this only reduces exposure and does not eliminate the underlying bug.

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-58222 HIGH
8.8 Jul 30

Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated

CVE-2026-5260 HIGH
8.2 May 26

Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap

CVE-2026-0966 HIGH
8.2 Mar 26

Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces

CVE-2026-42013 HIGH
8.2 May 26

Here is the multi-source synthesis as a single JSON object: ```json { "product_name": "GnuTLS", "summary": "Certifi

CVE-2026-14476 HIGH
8.0 Jul 07

Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Re

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed

Share

CVE-2026-40916 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy