Description
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.
Affected products
gimp: gimp; redhat: enterprise linux
References3
- access.redhat.com/security/cve/CVE-2026-59088 Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2496582 Issue TrackingVendor Advisory
- gitlab.gnome.org/GNOME/gimp/-/work_items/16492 ExploitMitigationVendor Advisory
Metrics
- CVSS 3.1
-
5.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 0% percentile: 26 · as of 12 November 2026
- CWE
- CWE-190
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.