CVE-2026-59089: 
NixOS vulnerability analysis and mitigation

CVE-2026-59089 is an integer overflow vulnerability in GIMP's PlayStation TIM image loader that can cause a denial of service. The flaw exists in the CLUT (Color Look-Up Table) size calculation within plug-ins/common/file-tim.c, where multiplying two 16-bit unsigned short integers (num_colors and num_cluts) can produce a value exceeding the maximum integer limit, triggering undefined behavior and causing the GIMP plug-in to abort. Affected software includes GIMP 3.2.4/3.2.6 and Red Hat Enterprise Linux 8.0 and 9.0. The vulnerability was reported on July 2, 2026, and publicly disclosed on July 6, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-190 (Integer Overflow or Wraparound). In plug-ins/common/file-tim.c at line 486, the expression guint clut_size = num_colors * num_cluts performs multiplication of two gushort (16-bit unsigned short) values. After integer promotion, the worst-case product (65535 × 65535 = 4,294,836,225) exceeds INT_MAX, resulting in undefined behavior detected by UBSan (Undefined Behavior Sanitizer). Exploitation requires an attacker to supply a specially crafted PlayStation TIM image file that a local user opens in GIMP, triggering the overflow during file parsing (Red Hat Bugzilla, Github Advisory).

Successful exploitation results in a denial of service: the GIMP plug-in aborts when processing the malicious TIM file, crashing the application. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability of the GIMP process. No lateral movement or privilege escalation potential has been identified, and the scope is confined to the affected GIMP instance (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious TIM file: Create a PlayStation TIM image file with num_colors and num_cluts fields set to values (e.g., both near 65535) such that their product overflows a 32-bit integer during CLUT size calculation.
2. Deliver the file: Distribute the crafted .tim file to a target user via email attachment, file share, or social engineering, relying on the user to open it in GIMP.
3. Trigger parsing: The victim opens the file in GIMP (version 3.2.4 or 3.2.6), causing the TIM loader plug-in to execute the vulnerable code path in plug-ins/common/file-tim.c at line 486.
4. Achieve denial of service: The integer overflow produces undefined behavior detected by the runtime, causing the GIMP plug-in to abort and the application to crash (Red Hat Bugzilla, Github Advisory).

• File System: Presence of unexpected or unsolicited .tim (PlayStation TIM format) image files in user download directories or temporary folders.
• Logs: Application crash logs or core dumps associated with the GIMP process (gimp, gimp-2.10, or plug-in helper processes); UBSan runtime error messages referencing file-tim.c:486 in GIMP debug output.
• Process: Abnormal termination of GIMP plug-in helper processes shortly after opening a TIM file; repeated GIMP crashes triggered by the same file.

Users should update GIMP to a patched version once available from the GNOME project or their Linux distribution. A patch was referenced via GNOME GitLab work item #16493 and GitHub Advisory GHSA-7v2w-74r7-8rq2, published July 6–10, 2026. As a workaround, users should avoid opening PlayStation TIM image files from untrusted sources, and administrators may consider disabling or restricting the TIM loader plug-in if it is not required in their environment (Github Advisory, Red Hat Bugzilla).

The vulnerability was assigned and disclosed by Red Hat's Product Security team, with the bug filed via OSIDB automated import. Coverage has been limited to automated vulnerability tracking services (VulnDB, CVEFeed, Vulners, OSV) and a brief mention on Bluesky via a CVE notification bot. No notable independent researcher commentary or significant media coverage has been identified beyond standard database aggregation.