Executive brief
GIMP, a popular open-source image editor, contains a flaw in how it processes PlayStation image files (TIM format). By tricking a user into opening a specially crafted image file, an attacker can cause the application's image-loading component to crash. This results in a denial of service, preventing the user from working with the software until it is restarted.
Technical details
An integer overflow vulnerability exists in the PlayStation TIM loader (`file-tim.c`) of GIMP due to improper calculation of the Color Look-Up Table (CLUT) size. The flaw occurs during the multiplication of two 16-bit unsigned short integers (`num_colors` and `num_cluts`); after integer promotion, the result can exceed `INT_MAX`, leading to undefined behavior and a signed integer overflow. An attacker can exploit this by providing a crafted TIM file with large color/CLUT values, causing the `file-tim` plug-in to abort or crash. The vulnerability was confirmed in GIMP version 3.2.4 via UBSan-instrumented builds.
Affected products
- GNOME GIMP 3.2.4
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
Timeline
- 2026-07-02: disclosed: Initial report via Red Hat Bugzilla and GNOME GitLab
- 2026-07-06: advisory: CVE published to NVD dataset