CVE-2026-59088CWE-190

CVE-2026-59088

Medium · published August 10, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.1th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-08-10T16:17Z
Affected products (3)
ProductVersionsFixed in
gimp/gimpall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (3)
https://access.redhat.com/security/cve/CVE-2026-59088 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2496582 · [email protected]https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492 · [email protected]
EPSS history
Timeline
  • 10 AUG 10:53Z
    Gimp: gimp: denial of service via signed integer overflow in fli file processing
    cvelistv5