{"id":"CVE-2026-59088","title":"Gimp: gimp: denial of service via signed integer overflow in fli file processing","summary":"A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multipli…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-190"],"vendor":"Red Hat","product":"gimp","affected":["gimp 3.2.4","gimp","gimp","gimp (all versions)","gimp (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-11T01:54:41.940533Z"},"published":"2026-08-10","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:18:02.921Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59088","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-59088"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496582","label":"RHBZ#2496582"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492"}],"tags":["cve.org"],"epss":0.00332,"epssPercentile":0.26492,"ingestedAt":"2026-11-05T23:41:31.948Z","slug":"CVE-2026-59088","body":"## Overview\n\nA flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.\n\n## Affected\n\n- `gimp 3.2.4`\n- `gimp`\n- `gimp`\n- `gimp (all versions)`\n- `gimp (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, users should avoid opening FLI image files from untrusted sources. As this vulnerability requires user interaction to open a specially crafted file, exercising caution with the origin of FLI files can prevent the denial of service.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}