Bug 2496583 (CVE-2026-59089)

Summary: CVE-2026-59089 gimp: GIMP: Denial of service via integer overflow in PlayStation TIM loader
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2497429    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-02 15:39:54 UTC 
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493

PlayStation TIM loader computes CLUT size as
guint clut_size = num_colors * num_cluts;
Both operands are gushort. After integer promotion, 65535 * 65535 = 4,294,836,225 > INT_MAX → undefined behavior. UBSan-detected; plug-in aborts.

File: plug-ins/common/file-tim.c:486
Version: GIMP 3.2.4