CVE-2026-59091 is a high severity out-of-bounds write in GIMP's file format plugins, including those for PSD and PAA files. A crafted image can cause unexpected behavior or other security impact once opened. No fixed version is confirmed, so check the Red Hat and GIMP advisories.
What's affected
- Product: GIMP, the image manipulation program, and the Red Hat Enterprise Linux packages of it.
- Affected versions: the record does not give a range. Check the Red Hat CVE page and the GIMP issue for affected and fixed builds.
- Fixed: not confirmed in the record or in the pages fetched. Treat the advisory as the source of truth for the fixed version.
- Trigger: a user opens a crafted image file. The record names the PSD and PAA plugins as examples of the affected file format code.
How to check if you're exposed
Find the GIMP build you run and where it came from.
gimp --version
rpm -q gimp
On other systems use the package manager of your distribution. Then compare against the fixed versions listed on the Red Hat CVE page once an erratum is published. At the time of the fetch the Red Hat Bugzilla entry showed status NEW, so a fix may not be released yet.
Also consider who opens files in GIMP on your systems. Design workstations, build servers that batch convert images, and image processing pipelines that call GIMP in scripts are the places where untrusted files arrive.
What to do now
- Check the Red Hat CVE page and the GIMP issue for a fixed version, and install it when it is available.
- Until then, avoid opening image files from untrusted sources in GIMP, especially the formats named in the record.
- Do not run GIMP in automated pipelines on untrusted uploads. If you must, use a sandbox with no network and no access to secrets.
- Run GIMP as an unprivileged user.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). The Red Hat Bugzilla title describes multiple vulnerabilities in file format plugins reachable through a crafted image file. The record is brief about details, and names PSD and PAA plugins as examples rather than a full list.
File loaders parse complex, attacker controlled structures, and bugs in them are a recurring source of memory corruption in image software. The record scores this one 7.3 (High) and requires a local user to open the file, with low privileges. Red Hat's bug tracker lists the priority and severity as high. The record does not mark it as exploited in the wild.
Quick check
Which formats are involved?
The record names the PSD and PAA plugins as examples. It speaks of file format plugins in general, so treat other formats from untrusted sources with the same care.
Sources
Last reviewed: 18 October 2026.
