CVE-2026-59089

A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.

Conditions for Exploitation: Successful exploitation requires user interaction. An attacker must trick a user into manually opening a specially crafted, malicious PlayStation TIM image file within the GIMP application.

Impact Limitations: The vulnerability is strictly limited to a localized Denial of Service (DoS) where the specific file loader plug-in aborts. It does not allow for remote code execution, data exfiltration, or privilege escalation, and it does not compromise the broader system or network security.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.