CVE-2026-59090

CVE Details

Release Date:	2026-08-10
Impact:	Important	What is this?

Description

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

See more information about CVE-2026-59090 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	8.4
Vector String:	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	High
Privileges Required:	Low
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	Low
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (gimp)	ELSA-2026-61587-0	2026-09-01