CVE-2026-59089: 
NixOS vulnerability analysis and mitigation

CVE-2026-59089 is an integer overflow vulnerability in GIMP's PlayStation TIM image loader that can cause a denial of service. The flaw exists in the CLUT (Color Look-Up Table) size calculation within plug-ins/common/file-tim.c, where multiplying two 16-bit unsigned short integers (num_colors and num_cluts) can produce a value exceeding the maximum integer limit, triggering undefined behavior and causing the GIMP plug-in to abort. The vulnerability was reported on July 2, 2026, and publicly disclosed on July 6, 2026, affecting GIMP 3.2.4/3.2.6 and Red Hat Enterprise Linux 8.0 and 9.0. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in GIMP's TIM file loader at plug-ins/common/file-tim.c, line 486. The vulnerable calculation guint clut_size = num_colors * num_cluts; performs arithmetic on two gushort (16-bit unsigned) values; after integer promotion, the product 65535 × 65535 = 4,294,836,225 exceeds INT_MAX, resulting in undefined behavior detected by UBSan. Exploitation requires a local attacker to supply a specially crafted PlayStation TIM image file and have a user open it in GIMP, triggering the overflow during CLUT size computation and causing the plug-in process to abort (Red Hat Bugzilla, Github Advisory).

Successful exploitation results in a denial of service — specifically, the GIMP plug-in process aborts when parsing a malicious TIM file. There is no impact on confidentiality or data integrity; only availability is affected, and the scope is limited to the GIMP application process itself. No lateral movement or data exfiltration risk has been identified for this vulnerability (Github Advisory, Red Hat Bugzilla).

1. Craft a malicious TIM file: Create a PlayStation TIM image file with num_colors and num_cluts fields set to values (e.g., both near 65535) such that their product overflows a 32-bit integer during CLUT size calculation in GIMP's TIM loader.
2. Deliver the file to the target: Distribute the crafted .tim file to a target user via email attachment, file share, or social engineering, since the attack vector is local and requires user interaction.
3. Trigger file opening: Convince the target user to open the malicious TIM file in GIMP (e.g., by disguising it or placing it in a directory the user is likely to browse).
4. Achieve denial of service: When GIMP's TIM loader processes the file and executes guint clut_size = num_colors * num_cluts; at file-tim.c:486, the integer overflow triggers undefined behavior, causing the GIMP plug-in process to abort and crash (Red Hat Bugzilla).

• File System: Presence of unexpected or suspicious .tim files in user download directories, temporary folders, or recently accessed file locations.
• Logs: GIMP crash logs or core dump files generated around the time a TIM file was opened; UBSan runtime error messages referencing file-tim.c:486 in application logs.
• Process: Abnormal termination of GIMP plug-in processes (e.g., gimp-2.99 or related plug-in helper processes) shortly after opening an image file.

Users should update GIMP to a version that includes the fix referenced in GNOME GitLab work item #16493, published on or after July 6, 2026. As a workaround, users should avoid opening PlayStation TIM image files from untrusted or unknown sources. System administrators may consider disabling the TIM file loader plug-in if PlayStation image support is not required in their environment (Github Advisory, GNOME GitLab).

The vulnerability received routine coverage from automated CVE tracking services and vulnerability databases shortly after disclosure on July 6, 2026. A brief mention appeared on Bluesky via a CVE notification account. No significant vendor statements beyond Red Hat's Bugzilla entry or notable independent researcher commentary have been identified (Red Hat Bugzilla).