CVE-2026-59090: GIMP PSD Plugin RCE Vulnerability

CVE-2026-59090 Overview

CVE-2026-59090 is an unsigned integer underflow vulnerability in the GNU Image Manipulation Program (GIMP) PSD file format plugin. The flaw resides in the block_rem variable, which underflows when a victim opens a specially crafted .psd image file. The resulting parser confusion allows an attacker to inject arbitrary data as layer resource blocks. Successful exploitation can lead to arbitrary code execution in the context of the user running GIMP. The weakness is classified under CWE-191: Integer Underflow (Wrap or Wraparound).

Critical Impact
A crafted PSD file can trigger arbitrary code execution on the victim's system through parser confusion in GIMP's layer resource block handling.

Affected Products

GIMP (GNU Image Manipulation Program) PSD file format plugin
Linux distributions shipping the affected GIMP package, as tracked by Red Hat
Any downstream application bundling the vulnerable GIMP PSD plugin

Discovery Timeline

2026-08-10 - CVE-2026-59090 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-59090

Vulnerability Analysis

The vulnerability lives in GIMP's PSD file format plugin, which parses Adobe Photoshop document layer structures. During processing of layer resource blocks, the plugin tracks the remaining bytes in a block using the unsigned block_rem counter. A crafted .psd file supplies size fields that cause block_rem to be decremented below zero. Because the variable is unsigned, the value wraps to a very large integer.

The parser then continues to consume data using this corrupted length, treating attacker-controlled bytes as legitimate layer resource block content. This parser confusion allows an attacker to inject arbitrary structured data into the parsing state. The condition ultimately enables arbitrary code execution in the process running GIMP.

Root Cause

The root cause is an unsigned integer underflow [CWE-191] in the block_rem accounting variable inside the PSD parser. The code subtracts consumed bytes from block_rem without validating that the subtracted value does not exceed the remaining count. Missing bounds checks on attacker-controlled length fields allow the wraparound to occur.

Attack Vector

Exploitation requires social engineering. An attacker must deliver a malicious .psd file to a victim through email, a web download, a shared repository, or a collaborative design workflow. The victim must open the file in a vulnerable version of GIMP. Because GIMP is commonly registered as the default handler for .psd files on Linux workstations, opening the file directly from a file manager can trigger the flaw. No authentication to the target system is required, and no additional user interaction beyond opening the file is needed.

A verified proof-of-concept is not publicly available. Technical details are tracked in GNOME GIMP Work Item #16509 and Red Hat Bugzilla Report #2496584.

Detection Methods for CVE-2026-59090

Indicators of Compromise

Unexpected child processes spawned by the gimp or gimp-console binary, such as shells, interpreters, or network utilities
.psd files arriving from untrusted sources, particularly those with anomalous file sizes or malformed headers
GIMP process crashes with segmentation faults immediately after opening a .psd file
Outbound network connections initiated by GIMP shortly after image import

Detection Strategies

Hunt for GIMP processes executing non-graphical child processes such as /bin/sh, bash, python, curl, or wget
Alert on file writes performed by GIMP outside expected user directories, particularly to autostart, cron, or shell configuration paths
Inspect .psd files at email and web gateways using file structure validation to flag malformed layer resource blocks

Monitoring Recommendations

Enable process execution and file integrity monitoring on workstations where GIMP is installed
Forward endpoint telemetry to a centralized log platform and retain PSD-open events for retrospective hunting
Track patch state of the GIMP package across all managed Linux, macOS, and Windows endpoints

How to Mitigate CVE-2026-59090

Immediate Actions Required

Inventory all systems with GIMP installed, including developer workstations, design endpoints, and container images
Instruct users to avoid opening .psd files received from untrusted senders until a patch is applied
Block or quarantine inbound .psd attachments at email gateways where the file type is not required for business operations
Apply distribution security updates as soon as the fixed GIMP package is published by your vendor

Patch Information

At the time of publication, tracking for the fix is available through GNOME GIMP Work Item #16509 and the Red Hat CVE-2026-59090 Advisory. Administrators should monitor these upstream sources and their Linux distribution security channels for the fixed GIMP version and update once available.

Workarounds

Do not open .psd files from untrusted sources in GIMP until the patched version is installed
Convert .psd files to a safer intermediate format such as .png or .tiff using a sandboxed converter before opening in GIMP
Run GIMP inside a restricted sandbox such as Flatpak with reduced filesystem and network permissions to limit the impact of exploitation
Remove GIMP from systems that do not require image editing functionality

bash

# Example: run GIMP in a restricted Flatpak sandbox with no network access
flatpak override --user --nosocket=x11 --nofilesystem=host --unshare=network org.gimp.GIMP

# Verify the currently installed GIMP version on Red Hat based systems
rpm -q gimp

# Verify the currently installed GIMP version on Debian based systems
dpkg -l | grep -i gimp