This vulnerability involves an incorrect calculation of buffer size in the PVR image loader component of GIMP on Red Hat Enterprise Linux 6. When a specially crafted PVR image file with large dimensions is processed, it triggers a stack-based buffer overflow and out-of-bounds read, causing the application to crash and resulting in a denial of service condition. The vulnerability affects systems that process untrusted PVR image files. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The impact of this vulnerability is a denial of service (DoS) condition caused by application crashes when processing maliciously crafted PVR image files. There is no reported impact on confidentiality or integrity. Systems that handle untrusted PVR image files are at risk of service disruption.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-40918 for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, avoid processing untrusted PVR image files to mitigate risk.