ZeroDay Findings
Sign inSign up

Findings

CVE-2026-40915

A flaw was found in GIMP.

Published Apr 15, 2026 · updated Jun 17, 2026 · gimp gimp

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 15, 2026 · NIST NVD

    Detected

    A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code exe

  2. Jun 17, 2026 · NIST NVD

    Updated

    A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code exe

Affected

  • cpe gimp/gimpversion unspecified
  • cpe redhat/enterprise linux6.0
  • cpe redhat/enterprise linux7.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0

Sources

  • CVE.orgVulnerability recordCVE-2026-40915

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-40915

    A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when pr

    nvd.nist.gov

References