CVE-2026-40916: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-40916 is a stack buffer overflow vulnerability in GIMP's TIM image loader affecting the 4BPP (4 bits-per-pixel) decoding path, allowing a local user to cause a Denial of Service (DoS) by opening a specially crafted TIM image file. The vulnerability was disclosed on April 15, 2026, and affects GIMP as packaged across Red Hat Enterprise Linux versions 6, 7, 8, and 9. The specific GIMP versions affected are not precisely enumerated in available advisories. It carries a CVSS v3.1 base score of 5.5 (Medium) per Red Hat, or 5.0 (Moderate) per the GitHub Advisory Database (Red Hat Advisory, GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in GIMP's TIM image loader. In the 4BPP decoding path, a variable-length array row[] is allocated with width bytes, but the decode loop writes 2 * width bytes into it — unconditionally overflowing the buffer by exactly width bytes with data derived from the image file. This means any crafted 4BPP TIM file can reliably trigger the overflow. Exploitation requires local access and user interaction (i.e., a user must open the malicious file), and no privileges are required (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation causes GIMP to crash, resulting in a Denial of Service for the affected user session. The impact is limited to availability — there is no confidentiality or integrity impact identified, and the scope is unchanged (confined to the GIMP process). Because the attack vector is local and requires user interaction, the blast radius is limited to individual workstations where a user opens a malicious TIM file (Red Hat Advisory, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-40916. The EPSS score is approximately 0.005% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory, Red Hat Advisory).

1. Craft a malicious TIM file: Create a 4BPP TIM image file with a width value chosen to maximize the stack overflow — the decode loop will write 2 * width bytes into a width-byte stack buffer, overflowing by exactly width bytes with attacker-controlled data from the file.
2. Deliver the file to the target: Use social engineering, a shared network drive, email attachment, or other local delivery mechanism to place the crafted .tim file on the victim's system.
3. Induce the user to open the file: Convince the target user to open the malicious TIM file in GIMP (e.g., by disguising it or placing it in a directory the user is likely to browse).
4. Trigger the crash: GIMP's TIM image loader processes the file, the 4BPP decode loop overflows the stack buffer, and the application crashes — achieving a Denial of Service (Red Hat Bugzilla).

• File System: Presence of unexpected or suspicious .tim files in user download directories, shared folders, or email attachments.
• Logs: Application crash logs or core dump files associated with the GIMP process (e.g., entries in /var/log/messages, ~/.xsession-errors, or systemd journal showing GIMP segmentation faults).
• Process: GIMP process terminating abnormally (signal 11/SIGSEGV or similar) shortly after opening a TIM image file.

No patched GIMP version has been publicly identified in available advisories as of the disclosure date; the Red Hat Bugzilla entry shows the bug status as "NEW" with no fixed version listed. Users should avoid opening TIM image files from untrusted sources in GIMP. Organizations running RHEL should monitor Red Hat's security advisories for errata updates addressing this CVE. As a general workaround, restrict access to GIMP on systems where untrusted image files may be processed (Red Hat Advisory, Red Hat Bugzilla).

Coverage of CVE-2026-40916 has been limited, consistent with its medium severity and local-only attack vector. A Heise article from around the time of disclosure referenced GIMP vulnerabilities involving image file handling, though it focused on a separate GIF-related issue. No notable researcher commentary or significant community discussion specific to this CVE has been identified in available sources.