This vulnerability involves an integer overflow in the FITS image loader of GIMP on Red Hat Enterprise Linux 6. When processing a maliciously crafted FITS file, the integer overflow causes a zero-byte memory allocation, which is then subjected to a heap buffer overflow when pixel data is handled. This can result in denial of service or potentially allow arbitrary code execution. The vulnerability is documented under CVE-2026-40915 with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Red Hat has published an advisory but has not indicated an available patch or remediation level at this time.

Successful exploitation can cause denial of service by crashing the application processing the FITS file. There is also potential for arbitrary code execution, which could allow an attacker to execute code on the affected system with the privileges of the user running GIMP. The attack vector requires local access (AV:L) and user interaction (UI:R), and no confidentiality or integrity impact is indicated.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40915 for current remediation guidance. Until a patch is available, users should exercise caution when opening FITS files from untrusted sources and consider restricting access to the vulnerable component. No official fix or temporary workaround has been documented by Red Hat as of now.