CVE-2026-40915 MEDIUM

CVE-2026-40915: Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Weakness CWE-190
Published April 15, 2026
Last update April 28, 2026

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution.

Key dates

02Disclosure timeline

April 15, 2026 CVE published
April 28, 2026 Record updated