{"id":"CVE-2026-59090","aliases":["ALSA-2026:61587","CLSA-2026-1787330254","CLSA-2026-1787333229","DEBIAN-CVE-2026-59090","EUVD-2026-55616","GHSA-gfh5-q868-q4pw","MGASA-2026-0578","OESA-2026-3573","RHSA-2026:61587","RHSA-2026:73768","RHSA-2026:80509","SUSE-SU-2026:3688-1","SUSE-SU-2026:4309-1","UBUNTU-CVE-2026-59090","openSUSE-SU-2026:11547-1"],"status":"published","title":"Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow","description":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0076,"percentile":0.55605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2026-08-10T12:10:40Z","modified":"2026-11-07T04:45:03Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel-tools","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-libs","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel-tools","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-libs","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gimp","fixed_in":["3.0.4-3+deb13u10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gimp","fixed_in":["3.2.6-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"gimp","fixed_in":["3.2.4-7.oe2403sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.34-1+deb12u1","2.10.34-1+deb12u10","2.10.34-1+deb12u2","2.10.34-1+deb12u3","2.10.34-1+deb12u4","2.10.34-1+deb12u5","2.10.34-1+deb12u6","2.10.34-1+deb12u7","2.10.34-1+deb12u8","2.10.34-1+deb12u9","2.10.36-1","2.10.36-2","2.10.36-3","2.10.38-1","2.10.38-2","2.99.10-1","2.99.12-1","2.99.12-2","2.99.14-1","2.99.14-2","2.99.16-1","2.99.16-2","2.99.18-1","3.0.0-1","3.0.0-2","3.0.0~RC1-1","3.0.0~RC1-3","3.0.0~RC1-4","3.0.0~RC2-1","3.0.0~RC3-1","3.0.2-1","3.0.2-2","3.0.2-3","3.0.2-3.1","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1","3.2.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-3+deb13u10"}]}],"versions":["3.0.4-3","3.0.4-3+deb13u1","3.0.4-3+deb13u2","3.0.4-3+deb13u3","3.0.4-3+deb13u4","3.0.4-3+deb13u5","3.0.4-3+deb13u6","3.0.4-3+deb13u7","3.0.4-3+deb13u8","3.0.4-3+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-1"}]}],"versions":["3.0.4-3","3.0.4-4","3.0.4-5","3.0.4-6","3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0-1","3.2.0~RC2-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8-1.mga10"}]}],"bundled":28},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-7.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-devel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gimp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.4-4.el9_8.10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-devel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gimp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.20"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-devel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gimp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_4.19"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.61.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.61.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.74.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.74.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.14-1ubuntu2","2.8.14-1.2ubuntu1","2.8.16-1ubuntu1","2.8.16-1ubuntu1.1","2.8.16-1ubuntu1.1+esm1","2.8.16-1ubuntu1.1+esm2","2.8.16-1ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.20-1","2.8.20-1.1","2.8.20-2","2.8.22-1","2.8.22-1ubuntu0.1~esm1","2.8.22-1ubuntu0.1~esm2","2.8.22-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.8-2","2.10.14-2","2.10.14-2build1","2.10.14-2ubuntu1","2.10.14-3","2.10.18-1","2.10.18-1ubuntu0.1","2.10.18-1ubuntu0.1+esm1","2.10.18-1ubuntu0.1+esm2","2.10.18-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.24-2","2.10.28-1","2.10.30-1","2.10.30-1build1","2.10.30-1ubuntu0.1","2.10.30-1ubuntu0.1+esm1","2.10.30-1ubuntu0.1+esm2","2.10.30-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.34-1","2.10.36-1","2.10.36-2","2.10.36-3build2","2.10.36-3build3","2.10.36-3ubuntu0.24.04.1","2.10.36-3ubuntu0.24.04.1+esm1","2.10.36-3ubuntu0.24.04.1+esm2","2.10.36-3ubuntu0.24.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-1","3.2.4-1","3.2.4-2","3.2.4-3","3.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-6.1","3.0.4-6.2","3.0.6-1","3.2.0~RC2-2","3.2.0~RC2-3","3.2.0~RC2-3.1","3.2.0~RC2-3.2","3.2.0~RC2-3.3","3.2.0~RC3-1","3.2.0-1","3.2.2-1","3.2.2-1ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-4.1"}]}],"bundled":4}],"products":[{"vendor":"gimp","product":"gimp"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:61587","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73768","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80509","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93589","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59090","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496584","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16509","tags":["exploit","Exploit","Mitigation","Vendor Advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59090","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gfh5-q868-q4pw"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18301","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18302","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18303","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18304","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18305","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18306","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18307","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18308","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496584","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520560","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520561","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520576","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520579","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520582","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520583","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520591","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520594","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61587.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787330254.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787333229.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59090","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0578.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36194","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LUXP5VNBOZ64AC65YKLO3MBCA4XXR3YS/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00381.html","tags":["web"]},{"url":"https://www.gimp.org/news/2026/09/10/gimp-3-2-6-released/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/AXAWJZC67JFATQTC4ZYX23XZMXR7SZXO/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00421.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/C7EXHOBQOGSI72FUDZQDNV4DYSYL6PXM/","tags":["web"]},{"url":"https://www.gimp.org/news/2026/11/02/gimp-3-2-8-released/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3573","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520594","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61587.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18301","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2772","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-454/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18302","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/77e1a11636fae53c922fe92273b8f4e33c7a9176","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-455/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18303","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/5633b362026c6e5b2beb559a10cd76fa32a47592","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-456/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18304","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/ad32d22c347674fa1bb5b60935c376b673d946e7","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-457/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18305","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/0a45a2b51b877829ef523131b50c0eb2a933b8a1","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-458/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18306","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/76531da9732f38566e5fd8f8f80c837158511ae5","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-459/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18307","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/bace3e7fd54104fe6b70c1703e9b982a4770811d","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-460/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18308","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18308","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/d84f8e58f56681a0b4c66129c568cb796725ab9d","tags":["article"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-461/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59090","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507475","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73768.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58379","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16205","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58380","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16206","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58384","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58384","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16216","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-66758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66758","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66758","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/16528","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80509.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263688-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274837","tags":["report"]},{"url":"https://bugzilla.suse.com/1274840","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264309-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273151","tags":["report"]},{"url":"https://bugzilla.suse.com/1276911","tags":["report"]},{"url":"https://bugzilla.suse.com/1277378","tags":["report"]},{"url":"https://bugzilla.suse.com/1279838","tags":["report"]},{"url":"https://bugzilla.suse.com/1279839","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80101","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-59090","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59091","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-59090","title":"Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow","description":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.","status":"published","published":"2026-08-10T12:10:40.052Z","modified":"2026-11-02T09:58:53.043Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-55616","description":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.","status":"published","published":"2026-08-10T12:10:40Z","modified":"2026-11-04T23:07:22Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-gfh5-q868-q4pw","title":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer...","description":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.","status":"published","published":"2026-08-10T15:33:35Z","modified":"2026-11-02T12:30:21Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:14:55.927217Z"}],"nvd":[{"id":"CVE-2026-59090","description":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.","status":"published","published":"2026-08-10T13:19:51.573Z","modified":"2026-11-04T23:17:53.413Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-191"],"updated_at":"2026-11-05T01:45:10.513148Z"}],"osv":[{"id":"DEBIAN-CVE-2026-59090","description":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.","status":"published","published":"2026-08-10T13:19:51.573Z","modified":"2026-11-05T10:00:28.849948521Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-3573","title":"gimp security update","description":"The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GIMP\u0026apos;s PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim\u0026apos;s system.(CVE-2026-59090)","status":"published","published":"2026-08-30T04:17:51Z","modified":"2026-08-30T04:32:02.777143894Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:61587","title":"Red Hat Security Advisory: gimp security update","status":"published","published":"2026-09-01T10:28:30Z","modified":"2026-10-12T10:06:49Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:73768","title":"Red Hat Security Advisory: gimp security update","status":"published","published":"2026-10-01T10:21:02Z","modified":"2026-10-12T10:08:29Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:80509","title":"Red Hat Security Advisory: gimp security update","status":"published","published":"2026-10-14T10:31:47Z","modified":"2026-10-14T10:48:08.656415964Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-59090","description":"A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.","status":"published","published":"2026-08-10T13:19:00Z","modified":"2026-10-17T12:59:13.755426046Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","level":"high"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:61587","title":"Important: gimp security update","description":"The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.  \n\nSecurity Fix(es):  \n\n  * gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow (CVE-2026-59090)\n  * gimp: GIMP: Arbitrary code execution via crafted TIF file parsing (CVE-2026-18304)\n  * gimp: GIMP: Remote code execution via PSD file parsing integer overflow (CVE-2026-18301)\n  * gimp: GIMP: Remote Code Execution via TIF File Parsing Integer Overflow (CVE-2026-18308)\n  * gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18302)\n  * gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow (CVE-2026-18305)\n  * gimp: GIMP: Remote code execution via TIF file parsing vulnerability (CVE-2026-18303)\n  * gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow (CVE-2026-18306)\n  * gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow (CVE-2026-18307)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:36.987270083Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1787330254","title":"gimp: Fix of CVE-2026-59090","description":"- CVE-2026-59090: prevent unsigned integer underflow of block_rem in the PSD\n  loader by bounds-checking the blending ranges length, the layer name length\n  and the layer resource header size before subtracting them","status":"published","published":"2026-08-21T16:37:44Z","modified":"2026-10-26T09:30:32.331012948Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787333229","title":"gimp: Fix of CVE-2026-59090","description":"- CVE-2026-59090: prevent unsigned integer underflow of block_rem in the PSD\n  loader by bounds-checking the blending ranges length, the layer name length\n  and the layer resource header size before subtracting them","status":"published","published":"2026-08-21T17:27:18Z","modified":"2026-10-26T09:31:30.297512415Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0578","title":"Updated gimp packages fix security vulnerabilities","description":"This update to v. 3.2.8 fixes several security issues.\n","status":"published","published":"2026-11-07T04:34:18Z","modified":"2026-11-07T04:45:03.545119581Z","updated_at":"2026-11-07T05:09:09.270904Z"},{"id":"openSUSE-SU-2026:11547-1","title":"gimp-3.2.4-4.1 on GA media","description":"These are all security issues fixed in the gimp-3.2.4-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-08-21T09:15:32.935119534Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:3688-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\n- CVE-2026-59088: GIMP: Denial of service via signed integer overflow in FLI file processing (bsc#1274837).\n- CVE-2026-59090: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).\n","status":"published","published":"2026-08-21T18:29:47Z","modified":"2026-08-26T18:23:32.907077053Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4309-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-59088: denial of service via signed integer overflow in FLI file processing (bsc#1274837).\n- CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).\n- CVE-2026-66757: signed integer overflow in `file-sgi` causes the plugin to crash when RLE-compressed SGI images are\n  processed (bsc#1273151).\n- CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations\n  (bsc#1277378).\n- CVE-2026-80101: independent header field validation in the XWD loader can cause heap out-of-bounds reads\n  (bsc#1276911).\n    \nNon security issues fixed:\n\n- RLE-compressed SGI files are written with a bad offset table and 57 of 144 scanlines fail to decode, on the patched\n  and the released build alike (bsc#1279838).\n- XWD bytes-per-line guard can never fire, and load_xwd_f1_d24_b1() still allocates the unchecked header field\n  (bsc#1279839).\n","status":"published","published":"2026-09-23T13:18:47Z","modified":"2026-09-24T11:15:06.892805779Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}