CVE-2026-40916: Gimp: gimp: denial of service due to stack buffer overflow in tim image loader
A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.
Other sources
The TIM image loader has a stack buffer overflow in the 4BPP decoding path. A variable-length array row[] is allocated as width bytes, but the decode loop writes 2 width bytes into it, unconditionally overflowing by exactly width bytes with data derived from the file. Opening any crafted 4BPP TIM file triggers the overflow and crashes GIMP.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40916?
CVE-2026-40916 has been classified as a high-severity vulnerability due to its potential to cause Denial of Service.
How do I fix CVE-2026-40916?
To fix CVE-2026-40916, ensure that you update GIMP to the latest version where this vulnerability has been addressed.
What type of vulnerability is CVE-2026-40916?
CVE-2026-40916 is a stack buffer overflow vulnerability in the TIM image loader of GIMP.
Who is affected by CVE-2026-40916?
Users of GIMP who open specially crafted TIM image files are at risk of being affected by CVE-2026-40916.
Can CVE-2026-40916 be exploited remotely?
CVE-2026-40916 cannot be exploited remotely as it requires local user interaction to open the malicious TIM image file.