CVE-2026-40916 describes a stack buffer overflow vulnerability in the TIM image loader component of GIMP on Red Hat Enterprise Linux 6. The vulnerability occurs in the 4BPP decoding path, where processing a maliciously crafted TIM image file causes an unconditional overflow when writing to a variable-length array on the stack. This results in a denial of service (application crash) when exploited by a local user. The vulnerability has a CVSS 3.1 base score of 5.0, indicating medium severity, with attack vector local, low attack complexity, low privileges required, and user interaction needed. No confidentiality or integrity impact is noted, only availability is affected.

The vulnerability allows a local attacker to cause a denial of service by crashing the GIMP application when opening a specially crafted TIM image file. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40916 for current remediation guidance. No official fix or workaround is explicitly stated in the provided data. Until a patch is available, avoid opening untrusted TIM image files with GIMP on affected systems.