---
id: CVE-2026-59088
title: >-
  Gimp: gimp: denial of service via signed integer overflow in fli file
  processing
summary: >-
  A flaw was found in GIMP. A signed integer overflow vulnerability exists in
  the `file-fli` plugin when processing FLI image files. This occurs due to an
  incorrect calculation during memory allocation for image buffers, where the
  multipli…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-190
vendor: Red Hat
product: gimp
affected:
  - gimp 3.2.4
  - gimp
  - gimp
  - gimp (all versions)
  - gimp (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-11T01:54:41.940533Z'
published: '2026-08-10'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:18:02.921Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59088'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59088'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496582'
    label: RHBZ#2496582
  - url: 'https://gitlab.gnome.org/GNOME/gimp/-/work_items/16492'
tags:
  - cve.org
epss: 0.00332
epssPercentile: 0.26492
ingestedAt: '2026-11-05T23:41:31.948Z'
---

## Overview

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.

## Affected

- `gimp 3.2.4`
- `gimp`
- `gimp`
- `gimp (all versions)`
- `gimp (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, users should avoid opening FLI image files from untrusted sources. As this vulnerability requires user interaction to open a specially crafted file, exercising caution with the origin of FLI files can prevent the denial of service.