CVE-2026-40915
CWE-190Published: April 15, 2026· Updated: Apr 17, 2026
Official Description
A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution.
Technical Analysis
CVE-2026-40915 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.
A successful exploit results in availability disruption (denial of service), with a CVSS base score of 5.5.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-190)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-40915 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts