CVE-2026-59090

Public on 2026-08-10
Modified on 2026-08-12
Description
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Gimp Extra gimp Pending Fix
Amazon Linux 2 - Gimp Extra gimp-data-extras Not Affected
Amazon Linux 2 - Gimp Extra gimp-help Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H