Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-59091Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file

High 7.3

In plain English

A high-severity out-of-bounds write in gimp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14gimp3.2.6-1DEBIAN-CVE-2026-59091
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-59091
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-59091

Affected products (as reported)

VendorProductVersions
gimp 3.2.6
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References