Executive brief
GIMP is a widely-used image editing application. A vulnerability in its FLI image file handler could crash the application when processing a specially crafted file, temporarily disrupting users' work and potentially affecting automated image processing workflows that depend on GIMP's availability.
Technical details
A signed integer overflow vulnerability exists in GIMP's file-fli plugin during FLI image file processing. The vulnerability occurs in memory allocation logic where multiplication of image width and height values can exceed the maximum signed integer value, leading to incorrect buffer allocation. A remote attacker can exploit this by crafting a malicious FLI file and inducing a user to open it, causing a denial of service through application crash. The vulnerability requires user interaction (opening a file) and is network-reachable if the file is provided via network means.
Affected products
- GIMP GIMP <UNKNOWN>
Timeline
- 2026-08-10: disclosed