CVE-2026-59090
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Key facts
- CVSS score
- 8.4 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H- Weakness (CWE)
- CWE-191
- EPSS score
- 0.6% (50th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2026-55616)
- Published
- August 10, 2026
- NVD last modified
- October 12, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2026-55616 in the EU Vulnerability Database. Last updated in EUVD on October 12, 2026.
View on the EU Vulnerability DatabaseAffected products
- gimp / gimp
- redhat / enterprise linux
- redhat / enterprise linux
- redhat / enterprise linux
Certified products that may be affected
31 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
- Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
- Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
- Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
- Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
See all 31 in the Security Certifications Explorer.
References
- https://access.redhat.com/errata/RHSA-2026:61587
- https://access.redhat.com/errata/RHSA-2026:73768
- https://access.redhat.com/errata/RHSA-2026:80509
- https://access.redhat.com/security/cve/CVE-2026-59090(Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2496584(Issue Tracking, Vendor Advisory)
- https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509(Exploit, Mitigation, Vendor Advisory)
Last updated October 13, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain