CVE-2026-40915

CVE-2026-40915 is an integer overflow vulnerability in GIMP's FITS image loader that allows a remote attacker to trigger a zero-byte memory allocation followed by a heap buffer overflow through a specially crafted FITS file. The vulnerability affects the GIMP image editing application and could result in denial of service or potentially arbitrary code execution on affected systems. The vulnerability is rated as CVSS 5.5 MEDIUM severity with a local attack vector, low complexity, and no privileges required. However, user interaction is necessary to exploit the flaw, such as opening a malicious FITS file. The primary impact is availability loss, with no direct confidentiality or integrity compromise indicated by the CVSS vector. There is currently no evidence of active exploitation in the wild, with no known exploit code publicly available and the vulnerability not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.00025 indicates a very low probability of exploitation compared to other CVEs, and community attention remains minimal. This suggests the vulnerability poses limited immediate risk despite its potential for code execution.