---
id: CVE-2026-40918
title: 'Gimp: gimp: denial of service via crafted pvr image file'
summary: >-
  A flaw was found in GIMP. Processing a specially crafted PVR image file with
  large dimensions can lead to a denial of service (DoS). This occurs due to a
  stack-based buffer overflow and an out-of-bounds read in the PVR image loader,
  caus…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-131
vendor: Red Hat
product: gimp
affected:
  - gimp (all versions)
  - gimp (all versions)
  - 'gimp:2.8/gimp (all versions)'
  - gimp (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-16T14:13:07.619463Z'
published: '2026-04-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:25:01.129Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-40918'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-40918'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2458747'
    label: RHBZ#2458747
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.09356
ingestedAt: '2026-11-05T22:38:32.093Z'
---

## Overview

A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This occurs due to a stack-based buffer overflow and an out-of-bounds read in the PVR image loader, causing the application to crash. Systems that process untrusted PVR image files are affected.

## Affected

- `gimp (all versions)`
- `gimp (all versions)`
- `gimp:2.8/gimp (all versions)`
- `gimp (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To reduce the risk associated with this vulnerability, avoid processing untrusted PVR image files. Users should exercise caution when opening PVR files from unknown or suspicious sources. If the PVR image loader is part of an application that processes untrusted content, consider running that application in a sandboxed environment to limit potential impact.