CVE-2026-59090

CVE-2026-59090 is an unsigned integer underflow (CWE-191) in the block_rem variable of GIMP's PSD file-format plugin. It is triggered when a user opens a specially crafted .psd image file, causing the parser to lose track of block boundaries and allowing an attacker to inject arbitrary data as layer resource blocks. Successful exploitation can ultimately result in arbitrary code execution on the victim's system. Any system running a vulnerable GIMP build, including the GIMP package shipped with Red Hat Enterprise Linux, is affected if it is used to open untrusted PSD files; the source data does not specify affected or fixed version ranges. No in-the-wild exploitation is reported (not in CISA KEV, EPSS ~0.6%), but a public proof-of-concept reference exists via the GNOME GitLab issue tracker (issue #16509).

What to do: Inventory endpoints for GIMP installations, prioritizing users who receive third-party PSD files, and upgrade to a patched GIMP build once Red Hat or GNOME publish fixed versions (no fixed version is given in this data; track GNOME GitLab issue #16509 and Red Hat security advisories). Until patched, treat unsolicited or untrusted .psd files as untrusted input and open them only in a sandboxed environment or with an alternative viewer. Note the reported EPSS probability (0.6%) is low and there is no KEV listing, so this is a hardening priority rather than an active-incident response.