PT-2026-33129 · Gimp · Gimp

Mzfr · Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-40918

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This issue is caused by a stack-based buffer overflow and an out-of-bounds read in the PVR image loader, which results in the application crashing. Systems that process untrusted PVR image files are affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-131

Related Identifiers

BDU:2026-05647

CVE-2026-40918

Affected Products

Gimp

References · 14

• https://access.redhat.com/security/cve/CVE-2026-40918 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2458747 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40918 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40918 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05647 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40918 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40918 · Security Note
• https://ubuntu.com/security/CVE-2026-40918 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40918 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16058 · Note
• https://access.redhat.com/security/cve/cve-2026-40918 · Note
• https://twitter.com/CVEnew/status/2044737925133275333 · Twitter Post
• https://heise.de/en/news/Gimp-Unpatched-vulnerability-allows-code-injection-with-GIFs-11260781.html · Note
• https://gitlab.gnome.org/GNOME/gimp/-/commit/7612363d8cdc574d482433a3897a24612bee4d81 · Note