Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-59090Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

High 8.4

In plain English

A high-severity security flaw in gimp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.6%top 48.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gimp2:3.0.4-4.el9_8.10ALSA-2026:61587
AlmaLinux:9gimp-libs2:3.0.4-4.el9_8.10ALSA-2026:61587
Debian:12gimpno fix listedDEBIAN-CVE-2026-59090
Debian:13gimp3.0.4-3+deb13u10DEBIAN-CVE-2026-59090
Debian:14gimp3.2.6-1DEBIAN-CVE-2026-59090
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-59090
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-59090

Affected products (as reported)

VendorProductVersions
gimp 3.3.1
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-191 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

References