Bug 2496582 (CVE-2026-59088)

Summary:	CVE-2026-59088 gimp: GIMP: Denial of service via signed integer overflow in FLI file processing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	grannygame.org, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2513089
Bug Blocks:

Description OSIDB Bzimport 2026-07-02 15:36:47 UTC

https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492

fli_header.width and fli_header.height are gushort (uint16). The expression
fb  = g_malloc (fli_header.width * fli_header.height);
ofb = g_malloc (fli_header.width * fli_header.height);


performs the multiplication after C integer promotion to int. When both values are 65535 the product 4,294,836,225 exceeds INT_MAX (2,147,483,647) → undefined behavior. UBSan detects this and the plug-in aborts.
Affected code
/* plug-ins/file-fli/fli-gimp.c:541-546 */
image = gimp_image_new (fli_header.width, fli_header.height, GIMP_INDEXED);

fb  = g_malloc (fli_header.width * fli_header.height);
ofb = g_malloc (fli_header.width * fli_header.height);


File: plug-ins/file-fli/fli-gimp.c:545 (and the mirror at L546, L805, L806)
Version: GIMP 3.2.4

Comment 4 Octavia 2026-08-11 14:41:37 UTC

The signed integer overflow in FLI file processing is ( https://drifthuntersonline.io ) worth tracking, especially for applications that handle untrusted image files. Since the bug is currently marked NEW with no fixed version listed, updating to the patched GIMP release once available would be the safest approach.