CVE-2026-59090 is a high severity flaw (CVSS 8.4) in the GIMP PSD file plugin. An unsigned integer underflow in the block_rem variable confuses the parser when a user opens a crafted .psd file, and that can lead to code execution. Apply your distribution update.
What's affected
- GIMP, in the PSD file format plugin. The record lists no upstream version range.
- Red Hat Enterprise Linux ships affected builds. Errata RHSA-2026:61587, 73768 and 80509 cover specific releases.
- Fixed upstream version: not stated in the record.
How to check if you're exposed
Run gimp --version, or rpm -q gimp on RPM based systems and dpkg -l gimp on Debian and Ubuntu. Compare it with the fixed package in your distribution advisory. For Red Hat, pick the RHSA that matches your minor release.
Client software like this is tracked by your endpoint tools, not by a code scan, but the Gold directory is a quick way to look up the CVE record and its weakness class when you write the change ticket.
What to do now
- Find the distribution advisory for this CVE.
- Update the GIMP package.
- Do not open PSD files from unknown sources until you have updated.
- Ask whether GIMP is installed on servers or build hosts where it should not be.
After updating, confirm the new build on a sample of devices and then look for stragglers in your management console. Devices that were offline or switched off during the rollout tend to be the last ones patched.
Why it matters
This is CWE-191 (Integer Underflow). A counter that tracks the remaining block size goes below zero and wraps to a huge value. The parser then reads data it should not treat as layer resource blocks, and the record says an attacker can inject arbitrary data this way.
The attack needs the victim to open a file, which is why the exposure is mostly desktop users. The CISA KEV flag is false.
GIMP supports many file formats through plugins, and each parser is a place where a malformed file can cause harm. Opening files from email or the web is the usual route. Where GIMP is installed on shared workstations, an update through your normal package channel is enough.
Quick check
Is a server at risk?
Only if GIMP is installed and a user or script opens an untrusted PSD file.
Sources
Last reviewed: 19 October 2026.
