CVE-2026-59089 — MEDIUM (5.5)

Vulnerability Description

A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Gimp	Gimp	3.2.6
Redhat	Enterprise Linux	8.0

Related Weaknesses (CWE)

CWE-190

References

https://access.redhat.com/security/cve/CVE-2026-59089Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2496583Issue TrackingThird Party Advisory
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493ExploitIssue TrackingVendor Advisory
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493ExploitIssue TrackingVendor Advisory

FAQ

What is CVE-2026-59089?

CVE-2026-59089 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. Th...

How severe is CVE-2026-59089?

CVE-2026-59089 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-59089?

Check the references section above for vendor advisories and patch information. Affected products include: Gimp Gimp, Redhat Enterprise Linux.