CVEvulnerability
CVE-2026-59090
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2026-08-10
- Last modified
- 2026-10-12
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-191
Description
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Affected configurations
• gimp gimp 3.3.1
• redhat enterprise linux 7.0
• redhat enterprise linux 8.0
• redhat enterprise linux 9.0
Related
Weakness · CWE (1)
- CWE-191 Integer Underflow (Wrap or Wraparound) weakness
References
- https://access.redhat.com/errata/RHSA-2026:61587 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:73768 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:80509 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-59090 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2496584 Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509 Exploit, Mitigation, Vendor Advisory
- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509 Exploit, Mitigation, Vendor Advisory