CVE Intelligence
Analysis AI-assisted

CVE-2026-59090: GIMP PSD plugin: arbitrary code execution via unsigned integer underflow

A flaw in the PSD file format plugin of GIMP is caused by an unsigned integer underflow when a crafted .psd file is opened, and the record says this can lead to arbitrary code execution. NVD rates it critical with CVSS 9.9, while Red Hat scores it 8.4. The sources consulted show no confirmed exploitation, and the record does not state a fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a flaw in the PSD file format plugin of GIMP. An unsigned integer underflow in the block_rem variable occurs when a user opens a specially crafted PSD image. The underflow causes parser confusion, which the source says can let an attacker inject arbitrary data as layer resource blocks. The record states this can ultimately result in arbitrary code execution. The CWE assigned is CWE-191, Integer Underflow. See the NVD entry and the CVE Record.

Impact

  • The record describes arbitrary code execution as a possible outcome, running with the privileges of the user who opens the file.
  • NVD scores the issue at 9.9 (critical) and Red Hat at 8.4. The vector in the record indicates network attack, low privileges and high confidentiality, integrity and availability impact.
  • The description says the user must open a crafted file, which appears to conflict with the vector's no-user-interaction value. This discrepancy is unresolved in the record.

Affected products and versions

  • GIMP: the record lists version 3.3.1. It does not state a range of affected versions.
  • Red Hat Enterprise Linux entries appear in the record with versions 7.0, 8.0 and 9.0, plus several product variants for which the source did not specify versions.
  • The record gives no fixed version. Check the Red Hat CVE page and the Red Hat Bugzilla entry for vendor status.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. The record's SSVC data reports exploitation as proof-of-concept and automatable as no. The EPSS probability is 0.00645 with a percentile of 0.50297, dated 2026-10-23. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the GIMP work item, which the record lists as a mitigation reference.
  • Track vendor errata for Red Hat Enterprise Linux, such as RHSA-2026:80509, RHSA-2026:73768 and RHSA-2026:61587 listed in the record, and apply updates when they are available for your systems.
  • Until patched, avoid opening PSD files from untrusted sources and restrict GIMP use on sensitive systems.

Detection guidance

  • Monitor for unexpected GIMP crashes or abnormal process behavior when PSD files are opened.
  • Review file ingestion workflows that handle PSD images from external sources.
  • Watch for unexpected child processes or outbound activity spawned from image editing software.

Limitations of the available information

  • The record does not provide a fixed version for GIMP or Red Hat Enterprise Linux.
  • The vector and the description disagree on whether user interaction is required.
  • The record does not confirm which exploitation or proof-of-concept material exists, and one reference is tagged as Exploit without further detail.
  • Red Hat and NVD scores differ, and the record does not explain the difference.

Frequently asked questions

What is the core flaw in CVE-2026-59090?

The record describes an unsigned integer underflow in the block_rem variable of GIMP's PSD plugin, triggered when a user opens a crafted PSD file. The source says this can lead to arbitrary code execution.

Is this vulnerability known to be exploited in the wild?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted. The SSVC data in the record indicates a proof-of-concept level of exploitation.

Is a fixed version available?

The record does not state a fixed version. It lists a GIMP work item as a mitigation reference and several Red Hat errata, so check those sources for current status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.