CVE-2026-59089

A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.

• CWE-190

• https://access.redhat.com/security/cve/CVE-2026-59089Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2496583Issue Tracking, Third Party Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493Exploit, Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493Exploit, Issue Tracking, Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5908Integer overflow in Media in Google Chrome prior to 147.0.77…8.8
• CVE-2026-59083Improper Handling of URL Encoding (Hex Encoding) vulnerabili…9.1
• CVE-2026-59084Insufficient Technical Documentation vulnerability in Apache…9.1
• CVE-2026-59086A vulnerability has been identified in Simcenter Nastran (Al…7.8
• CVE-2026-59087A flaw was found in the GIMP image manipulation program, spe…7.8
• CVE-2026-59088A flaw was found in GIMP. A signed integer overflow vulnerab…5.5
• CVE-2026-5909Integer overflow in Media in Google Chrome prior to 147.0.77…8.8
• CVE-2026-59090A flaw was found in GIMP's PSD file format plugin. This vuln…8.4
• CVE-2026-59091A flaw was found in GIMP's file format plugins, including th…7.3
• CVE-2026-59092JuiceFS through 1.3.1, fixed in commit a46979c, contains an …7.7
• CVE-2026-59093Weaviate before 1.38.0 does not verify that a principal perf…8.8
• CVE-2026-59094Pathway through 0.31.1, fixed in commit d09722e, document st…8.7