This vulnerability involves an incorrect calculation of buffer size in the PVR image loader component of GIMP on Red Hat Enterprise Linux 6. When processing a maliciously crafted PVR image file with large dimensions, a stack-based buffer overflow and out-of-bounds read occur, causing the application to crash and resulting in a denial of service condition. The vulnerability affects systems that process untrusted PVR image files. The CVSS 3.1 score is 5.5 (medium severity), with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vendor advisory does not provide explicit patch or remediation details.

The impact of this vulnerability is a denial of service caused by application crashes when processing specially crafted PVR image files. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported. The vulnerability requires local access and user interaction to trigger.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40918 for current remediation guidance. Until a fix is available, avoid processing untrusted PVR image files with GIMP on affected systems to mitigate the risk of denial of service.