CVE-2026-40915 Details

An integer overflow vulnerability has been identified in the FITS image loader of GIMP. This flaw allows remote attackers to exploit the vulnerability by providing specially crafted FITS files. The integer overflow results in a zero-byte memory allocation, which, when processing pixel data, is subjected to a heap buffer overflow. Successful exploitation of this vulnerability could cause a denial-of-service condition or potentially allow arbitrary code execution.

Users are advised to avoid opening untrusted FITS image files with GIMP. If GIMP is not needed, consider removing the application to reduce the attack surface. On Red Hat Enterprise Linux systems, GIMP can be uninstalled using the package manager.