CVE-2026-59088

GIMP contains a signed integer overflow (CWE-190) in its file-fli plug-in, which decodes FLI animation image files; the width-times-height multiplication used to size image buffers can exceed the maximum signed integer value, producing an incorrect allocation. An attacker triggers the flaw by convincing a user to open a specially crafted FLI file, for example as an email attachment or download. Successful exploitation crashes the application, causing a denial of service; the CVSS vector (C:N/I:N/A:H) indicates no confidentiality or integrity impact and no code execution. Anyone running an affected GIMP build, including the GIMP packages shipped with Red Hat Enterprise Linux, is exposed, though exploitation requires user interaction. No in-the-wild exploitation is currently known: a public bug reference exists on the GIMP GitLab tracker, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Avoid opening FLI/FLIC files from untrusted sources until a fixed GIMP build is available. Track the upstream fix via the GIMP GitLab issue and apply the patched GIMP package through your distribution's update channel (e.g., Red Hat Enterprise Linux errata) as soon as it is released. Defenders should also confirm which workstations have GIMP installed and whether users handle FLI files to prioritize patching.