Every CVE Search/ Get API key

CVE-2026-59090

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

8.4 HighFix available

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
High

Exploit likelihood

0.76%Up 0.5 points since Aug 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.4

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Record
CVE-2026-59090
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Weakness
CWE-191
Updated
2026-11-02
EUVDEUVD-2026-55616 8.4

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Record
EUVD-2026-55616
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-gfh5-q868-q4pw 8.4

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer...

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Record
GHSA-gfh5-q868-q4pw
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Weakness
CWE-191
Updated
2026-11-02
NVD 8.4

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Record
CVE-2026-59090
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-191
Updated
2026-11-05
OSVDEBIAN-CVE-2026-59090 9.9

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Record
DEBIAN-CVE-2026-59090
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-05
OSVOESA-2026-3573 8.4

gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.(CVE-2026-59090)

Record
OESA-2026-3573
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVRHSA-2026:61587 8.4

Red Hat Security Advisory: gimp security update

Record
RHSA-2026:61587
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:73768 8.4

Red Hat Security Advisory: gimp security update

Record
RHSA-2026:73768
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80509 8.4

Red Hat Security Advisory: gimp security update

Record
RHSA-2026:80509
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-59090 8.4

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the block_rem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

Record
UBUNTU-CVE-2026-59090
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:61587 No score

Important: gimp security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow (CVE-2026-59090)
  • gimp: GIMP: Arbitrary code execution via crafted TIF file parsing (CVE-2026-18304)
  • gimp: GIMP: Remote code execution via PSD file parsing integer overflow (CVE-2026-18301)
  • gimp: GIMP: Remote Code Execution via TIF File Parsing Integer Overflow (CVE-2026-18308)
  • gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18302)
  • gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow (CVE-2026-18305)
  • gimp: GIMP: Remote code execution via TIF file parsing vulnerability (CVE-2026-18303)
  • gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow (CVE-2026-18306)
  • gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18307)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61587
Updated
2026-11-02
OSVCLSA-2026-1787330254 No score

gimp: Fix of CVE-2026-59090

  • CVE-2026-59090: prevent unsigned integer underflow of block_rem in the PSD loader by bounds-checking the blending ranges length, the layer name length and the layer resource header size before subtracting them
Record
CLSA-2026-1787330254
Updated
2026-11-02
OSVCLSA-2026-1787333229 No score

gimp: Fix of CVE-2026-59090

  • CVE-2026-59090: prevent unsigned integer underflow of block_rem in the PSD loader by bounds-checking the blending ranges length, the layer name length and the layer resource header size before subtracting them
Record
CLSA-2026-1787333229
Updated
2026-11-02
OSVMGASA-2026-0578 No score

Updated gimp packages fix security vulnerabilities

This update to v. 3.2.8 fixes several security issues.

Record
MGASA-2026-0578
Updated
2026-11-07
OSVopenSUSE-SU-2026:11547-1 No score

gimp-3.2.4-4.1 on GA media

These are all security issues fixed in the gimp-3.2.4-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11547-1
Updated
2026-11-02
OSVSUSE-SU-2026:3688-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2026-59088: GIMP: Denial of service via signed integer overflow in FLI file processing (bsc#1274837).
  • CVE-2026-59090: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).
Record
SUSE-SU-2026:3688-1
Updated
2026-11-02
OSVSUSE-SU-2026:4309-1 No score

Security update for gimp

This update for gimp fixes the following issues:

Security issues fixed:

  • CVE-2026-59088: denial of service via signed integer overflow in FLI file processing (bsc#1274837).
  • CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).
  • CVE-2026-66757: signed integer overflow in file-sgi causes the plugin to crash when RLE-compressed SGI images are processed (bsc#1273151).
  • CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations (bsc#1277378).
  • CVE-2026-80101: independent header field validation in the XWD loader can cause heap out-of-bounds reads (bsc#1276911).

Non security issues fixed:

  • RLE-compressed SGI files are written with a bad offset table and 57 of 144 scanlines fail to decode, on the patched and the released build alike (bsc#1279838).
  • XWD bytes-per-line guard can never fire, and load_xwd_f1_d24_b1() still allocates the unchecked header field (bsc#1279839).
Record
SUSE-SU-2026:4309-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
AlmaLinux:9
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp-libs
AlmaLinux:9
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els16
2:2.99.8-4.el9.2.tuxcare.els16
gimp-devel
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els16
2:2.99.8-4.el9.2.tuxcare.els16
gimp-devel-tools
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els16
2:2.99.8-4.el9.2.tuxcare.els16
gimp-libs
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els16
2:2.99.8-4.el9.2.tuxcare.els16
gimp
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els16
2:2.99.8-4.el9_6.2.tuxcare.els16
gimp-devel
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els16
2:2.99.8-4.el9_6.2.tuxcare.els16
gimp-devel-tools
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els16
2:2.99.8-4.el9_6.2.tuxcare.els16
gimp-libs
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els16
2:2.99.8-4.el9_6.2.tuxcare.els16
Show 35 moreShow less
Affected packages
PackageAffectedFixed
gimp
Debian:12
 All versions, plus listed versions
2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3
Show 45 moreShow less
2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2
 None known
gimp
Debian:13
 before 3.0.4-3+deb13u10, plus listed versions
3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u23.0.4-3+deb13u33.0.4-3+deb13u4
Show 5 moreShow less
3.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u9
3.0.4-3+deb13u10
gimp
Debian:14
 before 3.2.6-1, plus listed versions
3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1
Show 14 moreShow less
3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-3
3.2.6-1
gimp
Mageia:10
From an advisory covering 28 CVEs
 before 3.2.8-1.mga10
3.2.8-1.mga10
gimp
openEuler:24.03-LTS-SP4
 before 3.2.4-7.oe2403sp4
3.2.4-7.oe2403sp4
gimp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp-devel-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 2:3.0.4-4.el9_8.10
2:3.0.4-4.el9_8.10
gimp
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_6.20
2:2.99.8-4.el9_6.20
gimp-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_6.20
2:2.99.8-4.el9_6.20
gimp-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_6.20
2:2.99.8-4.el9_6.20
gimp-devel-tools-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_6.20
2:2.99.8-4.el9_6.20
gimp-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_6.20
2:2.99.8-4.el9_6.20
gimp-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_6.20
2:2.99.8-4.el9_6.20
gimp
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_4.19
2:2.99.8-4.el9_4.19
gimp-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_4.19
2:2.99.8-4.el9_4.19
gimp-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_4.19
2:2.99.8-4.el9_4.19
gimp-devel-tools-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_4.19
2:2.99.8-4.el9_4.19
gimp-libs
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_4.19
2:2.99.8-4.el9_4.19
gimp-libs-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 13 CVEs
 before 2:2.99.8-4.el9_4.19
2:2.99.8-4.el9_4.19
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 2.10.30-150400.3.61.1
2.10.30-150400.3.61.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 2 CVEs
 before 2.10.30-150400.3.61.1
2.10.30-150400.3.61.1
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 5 CVEs
 before 2.10.30-150400.3.74.1
2.10.30-150400.3.74.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 5 CVEs
 before 2.10.30-150400.3.74.1
2.10.30-150400.3.74.1
gimp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3
 None known
gimp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3
 None known
gimp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3
Show 5 moreShow less
2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3
Show 4 moreShow less
2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3
 None known
gimp
Ubuntu:26.10
 All versions, plus listed versions
3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1
 None known
gimp
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3
Show 7 moreShow less
3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1
 None known
gimp
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.2.4-4.1
3.2.4-4.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
affectedNVD, OSV
factsEUVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59090 is a high vulnerability (CVSS 8.4) in Gimp, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in gimp 2:2.99.8-4.el9.2.tuxcare.els16.

References

Show 123 moreShow less
This page doesn't list everything

Left out here: 8 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open