GIMP EUVD-2026-41913

Exploitation requires the target user to actively open a specially crafted PlayStation TIM image file within GIMP - the GIMP TIM loader plug-in must be present and enabled (default on RHEL GIMP packages). The overflow is triggered solely in the TIM format handler, so only files with the .tim extension or TIM magic bytes processed by that specific plug-in are affected; other image formats are not impacted. The attack vector is local (AV:L per CVSS), meaning the crafted file must be accessible on the victim's filesystem, not deliverable over a direct network protocol. User interaction is mandatory (UI:R): the victim must initiate the file open action. No authentication, no elevated privileges, and no non-default GIMP configuration are required beyond the TIM plug-in being installed. Exploitation is limited to denial of service (plug-in abort); there is no evidence from the description or CVSS vector of memory corruption reaching the level of code execution. Limiting factors include: (1) TIM files are uncommon outside retro gaming or PlayStation development workflows, reducing organic exposure; (2) the impact is bounded to crashing the plug-in, not the host system; (3) RHEL 6 and 7 are in extended/maintenance support phases with limited enterprise deployment.

Real-world risk is moderate-to-low. The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately characterizes the attack surface: exploitation is local (the crafted file must be opened on the victim's machine), requires user interaction, and yields only an availability impact - a plug-in abort, not full application compromise, data theft, or remote code execution. There is no EPSS data provided in the input and no CISA KEV listing, indicating no confirmed or widespread active exploitation. No public proof-of-concept has been identified. The practical threat model is limited to attackers who can deliver a malicious TIM file and persuade a user to open it in GIMP - a non-trivial social engineering bar. The absence of confidentiality or integrity impact further reduces prioritization relative to other open issues. One signal worth noting: the GNOME GitLab reference is a work item, not a merge request or tagged release, suggesting no upstream fix has landed yet; defenders on RHEL should monitor Red Hat's advisory page for patch availability.

An attacker crafts a PlayStation TIM image file with num_colors and num_cluts values chosen to trigger the 16-bit multiplication overflow - for example, 256 × 257 = 65,792, which truncates when stored in a 16-bit result - causing GIMP to allocate an undersized CLUT buffer. The attacker delivers this file to a target user via email attachment, shared drive, or web download, and persuades them to open it in GIMP. Upon loading, the TIM plug-in encounters the corrupted size calculation, invokes undefined behavior, and aborts, crashing the GIMP plug-in process and disrupting the user's session.