CVE-2026-40918: GIMP PVR Image Loader DoS Vulnerability

CVE-2026-40918 Overview

A flaw in the GNU Image Manipulation Program (GIMP) allows a crafted PVR image file with large dimensions to crash the application. The defect resides in the PVR image loader, where a stack-based buffer overflow and an out-of-bounds read are triggered during parsing. Processing untrusted PVR files results in a denial of service condition. The issue affects upstream GIMP and Red Hat Enterprise Linux distributions 6 through 9. The weakness is classified under [CWE-131] (Incorrect Calculation of Buffer Size).

Critical Impact
A local user who opens a malicious PVR image in GIMP can crash the process, disrupting workflows that rely on the image editor.

Affected Products

GIMP (all versions reported affected by the upstream advisory)
Red Hat Enterprise Linux 6, 7, 8, and 9
Any Linux distribution shipping the vulnerable GIMP PVR loader

Discovery Timeline

2026-04-15 - CVE-2026-40918 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-40918

Vulnerability Analysis

The flaw lives in the PVR image loader plugin shipped with GIMP. When the loader parses the PVR header, it trusts the width and height fields without enforcing sane upper bounds. Supplying large dimension values causes a buffer size miscalculation tracked as [CWE-131]. This miscalculation produces both a stack-based buffer overflow and an out-of-bounds read during pixel processing. The result is process termination rather than memory disclosure or code execution, as reflected by the impact metrics that mark only availability as affected.

Exploitation requires local access and user interaction: the victim must open the malicious .pvr file in GIMP. The vulnerability does not yield confidentiality or integrity loss. No public exploit, proof-of-concept, or CISA KEV entry exists for this issue. The EPSS data published 2026-05-13 reflects a very low expected exploitation rate.

Root Cause

The PVR loader computes allocation and read sizes from attacker-controlled dimension fields without validation. Oversized values cause the computed buffer size to exceed the fixed-size stack buffer used during decoding, and subsequent reads cross the end of the input data. The miscalculation pattern matches [CWE-131], where the program incorrectly calculates the size of a buffer relative to the data it stores.

Attack Vector

An attacker delivers a crafted PVR image through email, a shared drive, a website, or any channel that results in a user opening the file in GIMP. Once GIMP invokes the PVR loader on the file, the overflow and out-of-bounds read trigger immediately and the process crashes. The attack vector is local with required user interaction, and privileges are not needed beyond those of the user running GIMP.

// No verified proof-of-concept is publicly available for CVE-2026-40918.
// The vulnerability is triggered by opening a PVR image whose header
// declares oversized width/height values, causing the PVR loader to
// overflow a stack buffer and read beyond the input bounds.

Detection Methods for CVE-2026-40918

Indicators of Compromise

Unexpected GIMP process crashes correlated with opening .pvr files
Core dumps or SIGSEGV signals originating from the GIMP PVR loader plugin
Presence of unsolicited .pvr attachments delivered via email, chat, or downloads
Audit log entries showing GIMP launching on files received from untrusted sources

Detection Strategies

Monitor for abnormal termination of the gimp process and capture the loaded file path from process telemetry
Inspect PVR file headers for declared dimensions that exceed realistic limits before they reach user workstations
Hunt EDR telemetry for sequences where gimp opens a file from a temporary or download directory and exits abnormally
Correlate crash events with file delivery events to identify potential targeted DoS attempts

Monitoring Recommendations

Enable crash reporting on workstations running GIMP and forward reports to a central SIEM
Track installed GIMP versions across the fleet to confirm patch coverage once a fixed release is published
Alert on repeated GIMP crashes from the same user, which may indicate a delivered malicious file
Review mail and web gateways for .pvr attachments from external senders

How to Mitigate CVE-2026-40918

Immediate Actions Required

Apply vendor updates for GIMP as soon as a fixed package is published by your Linux distribution
Restrict opening of untrusted .pvr files until the patched version is deployed
Communicate the risk to design and content teams that routinely process third-party image assets
Track the Red Hat CVE-2026-40918 Advisory and Red Hat Bug Report #2458747 for status updates

Patch Information

At the time of publication, the Red Hat advisory tracks the issue under Red Hat CVE-2026-40918 Advisory. Administrators should monitor distribution package channels and apply updates to GIMP once the fixed version is released. Verify the installed version after patching using gimp --version and confirm package metadata through the system package manager.

Workarounds

Do not open PVR files received from untrusted or unverified sources
Use a sandboxed environment or disposable virtual machine when inspecting unknown image files
Configure file managers to avoid associating .pvr extensions with GIMP for users who do not need PVR support
Filter .pvr attachments at the mail gateway for user populations that do not legitimately exchange this format

bash

# Check installed GIMP version on Red Hat Enterprise Linux
rpm -q gimp

# Apply available updates once the vendor publishes a fix
sudo dnf update gimp

# Remove file association for .pvr if PVR support is not required
xdg-mime default text-plain.desktop application/octet-stream