Red HatCVE-2026-59090
Red Hat GIMP: integer overflow
No fix yet
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 6 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 7 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 8 Product | all versions | No fix yet |
| Red Hat, Inc.: CVE records (CNA) Product | <= 3.3.1 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-191
- www.cve.org/CVERecord?id=CVE-2026-59090
- nvd.nist.gov/vuln/detail/CVE-2026-59090
- access.redhat.com/errata/RHSA-2026:61587
- access.redhat.com/errata/RHSA-2026:73768
- access.redhat.com/errata/RHSA-2026:80509
- access.redhat.com/errata/RHSA-2026:93589
- access.redhat.com/security/cve/CVE-2026-59090
- bugzilla.redhat.com/show_bug.cgi?id=2496584
- gitlab.gnome.org/GNOME/gimp/-/work_items/16509