CVE-2026-59089
NixOS vulnerability analysis and mitigation

Overview

CVE-2026-59089 is an integer overflow vulnerability in GIMP's PlayStation TIM image loader that can cause a denial of service. The flaw exists in the CLUT (Color Look-Up Table) size calculation within plug-ins/common/file-tim.c, where multiplying two 16-bit unsigned short integers (num_colors and num_cluts) can produce a value exceeding the maximum integer limit, triggering undefined behavior and causing the GIMP plug-in to abort. Affected software includes GIMP 3.2.4/3.2.6 and Red Hat Enterprise Linux 8.0 and 9.0. The vulnerability was reported on July 2, 2026, and publicly disclosed on July 6, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

Technical details

The root cause is classified as CWE-190 (Integer Overflow or Wraparound). In plug-ins/common/file-tim.c at line 486, the expression guint clut_size = num_colors * num_cluts performs multiplication of two gushort (16-bit unsigned short) values. After integer promotion, the worst-case product (65535 × 65535 = 4,294,836,225) exceeds INT_MAX, resulting in undefined behavior detected by UBSan (Undefined Behavior Sanitizer). Exploitation requires an attacker to supply a specially crafted PlayStation TIM image file that a local user opens in GIMP, triggering the overflow during file parsing (Red Hat Bugzilla, Github Advisory).

Impact

Successful exploitation results in a denial of service: the GIMP plug-in aborts when processing the malicious TIM file, crashing the application. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability of the GIMP process. No lateral movement or privilege escalation potential has been identified, and the scope is confined to the affected GIMP instance (Github Advisory, Red Hat Bugzilla).

Exploitation steps

  1. Craft a malicious TIM file: Create a PlayStation TIM image file with num_colors and num_cluts fields set to values (e.g., both near 65535) such that their product overflows a 32-bit integer during CLUT size calculation.
  2. Deliver the file: Distribute the crafted .tim file to a target user via email attachment, file share, or social engineering, relying on the user to open it in GIMP.
  3. Trigger parsing: The victim opens the file in GIMP (version 3.2.4 or 3.2.6), causing the TIM loader plug-in to execute the vulnerable code path in plug-ins/common/file-tim.c at line 486.
  4. Achieve denial of service: The integer overflow produces undefined behavior detected by the runtime, causing the GIMP plug-in to abort and the application to crash (Red Hat Bugzilla, Github Advisory).

Indicators of compromise

  • File System: Presence of unexpected or unsolicited .tim (PlayStation TIM format) image files in user download directories or temporary folders.
  • Logs: Application crash logs or core dumps associated with the GIMP process (gimp, gimp-2.10, or plug-in helper processes); UBSan runtime error messages referencing file-tim.c:486 in GIMP debug output.
  • Process: Abnormal termination of GIMP plug-in helper processes shortly after opening a TIM file; repeated GIMP crashes triggered by the same file.

Mitigation and workarounds

Users should update GIMP to a patched version once available from the GNOME project or their Linux distribution. A patch was referenced via GNOME GitLab work item #16493 and GitHub Advisory GHSA-7v2w-74r7-8rq2, published July 6–10, 2026. As a workaround, users should avoid opening PlayStation TIM image files from untrusted sources, and administrators may consider disabling or restricting the TIM loader plug-in if it is not required in their environment (Github Advisory, Red Hat Bugzilla).

Community reactions

The vulnerability was assigned and disclosed by Red Hat's Product Security team, with the bug filed via OSIDB automated import. Coverage has been limited to automated vulnerability tracking services (VulnDB, CVEFeed, Vulners, OSV) and a brief mention on Bluesky via a CVE notification bot. No notable independent researcher commentary or significant media coverage has been identified beyond standard database aggregation.

Additional resources


SourceThis report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-45568CRITICAL9.9
  • Python logoPython
  • zrok
NoYesJul 16, 2026
CVE-2026-45576HIGH8.3
  • NixOS logoNixOS
  • zrok
NoYesJul 16, 2026
CVE-2026-36590HIGH7.5
  • NixOS logoNixOS
  • nanomq
NoNoJul 15, 2026
CVE-2026-59259MEDIUM6
  • NixOS logoNixOS
  • n8n
NoYesJul 15, 2026
CVE-2026-26032MEDIUM5.4
  • NixOS logoNixOS
  • ivy
NoYesJul 15, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management