CVE-2026-59090
criticalA flaw was found in GIMP's PSD file format plugin.
Vendor / product: Gimp — gimp
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
CVSS
9.9
9.9 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-08-10 13:19
Modified: 2026-10-12 03:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
gimp / gimp 3.3.1
redhat / enterprise_linux 7.0, 8.0, 9.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://access.redhat.com/security/cve/CVE-2026-59090
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2496584
Vendor advisory: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509
Vendor advisory: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509
Patch / mitigation: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509
Patch / mitigation: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509
References
- https://access.redhat.com/errata/RHSA-2026:61587 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:73768 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:80509 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2026-59090 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2496584 secalert@redhat.com
- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509 secalert@redhat.com
- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗