CVE-2026-40918

CVE-2026-40918 is a stack-based buffer overflow and out-of-bounds read vulnerability in GIMP's PVR image loader that can be triggered by processing specially crafted PVR image files with large dimensions, affecting any system that handles untrusted PVR image files. The vulnerability carries a CVSS score of 5.5 (MEDIUM) with a local attack vector requiring user interaction, resulting in denial of service through application crashes but without impacts to confidentiality or integrity. This vulnerability is not currently being actively exploited in the wild, has not been added to the Known Exploited Vulnerabilities catalog, and shows minimal community attention with an EPSS score of 0.000190000, indicating very low probability of exploitation. Organizations using GIMP should prioritize patching when updates become available, particularly on systems where users may open untrusted PVR image files, though the overall risk profile remains low at this time.