CVE-2026-40916

CVE-2026-40916 is a stack buffer overflow vulnerability in GIMP's TIM image loader, specifically in the 4BPP decoding path. The flaw is triggered when a user opens a specially crafted TIM image file, causing the application to crash due to an unconditional overflow in a variable-length array. This vulnerability affects GIMP users on local systems. The vulnerability has a CVSS score of 5.0 (Medium severity) with a local attack vector requiring low complexity and user interaction. While an attacker cannot gain unauthorized access or modify data, the impact is high availability loss as the application will crash when processing malicious TIM files. The EPSS score of 0.00005 indicates this is not a prevalent threat compared to other CVEs. There is no evidence of active exploitation at this time. The vulnerability is not listed in the Known Exploited Vulnerabilities catalog and remains inactive on threat lists. With a FAUCET Risk Score of 31.0/100 and minimal community attention, this appears to be a low-priority issue primarily relevant to organizations using GIMP in environments where users may be exposed to untrusted image files.