CVE-2026-59090 — HIGH (8.4)

Vulnerability Description

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

CVSS Score

8.4

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Gimp	Gimp	3.3.1
Redhat	Enterprise Linux	7.0

Related Weaknesses (CWE)

CWE-191

References

https://access.redhat.com/errata/RHSA-2026:61587
https://access.redhat.com/security/cve/CVE-2026-59090Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2496584Issue TrackingVendor Advisory
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509ExploitMitigationVendor Advisory
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509ExploitMitigationVendor Advisory

FAQ

What is CVE-2026-59090?

CVE-2026-59090 is a vulnerability with a CVSS score of 8.4 (HIGH). A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The un...

How severe is CVE-2026-59090?

CVE-2026-59090 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-59090?

Check the references section above for vendor advisories and patch information. Affected products include: Gimp Gimp, Redhat Enterprise Linux.