CVE-2026-59091: GIMP File Format Plugin RCE Vulnerability

CVE-2026-59091 Overview

CVE-2026-59091 is an out-of-bounds write vulnerability [CWE-787] affecting file format plugins in the GNU Image Manipulation Program (GIMP), including handlers for Photoshop Document (PSD) and PAA image files. A remote attacker can exploit this flaw by tricking a user into opening a specially crafted image file. Successful exploitation may cause unexpected application behavior, memory corruption, or other security impacts within the user context. The issue is tracked in Red Hat Bugzilla 2496585 and GNOME GIMP work item 16510.

Critical Impact
A crafted PSD or PAA file can trigger an out-of-bounds write in GIMP, leading to potential arbitrary code execution or application compromise in the context of the user opening the file.

Affected Products

GIMP file format plugins for PSD files
GIMP file format plugins for PAA files
Red Hat distributions shipping affected GIMP builds

Discovery Timeline

2026-08-10 - CVE-2026-59091 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-59091

Vulnerability Analysis

The vulnerability resides in GIMP's file format plugin subsystem, which parses image formats such as PSD and PAA. Under specific conditions, the plugins write data beyond the bounds of an allocated buffer while processing attacker-controlled fields in the file. This behavior maps directly to [CWE-787] Out-of-Bounds Write. An attacker crafts a malformed image and delivers it through email, a website, or shared storage. When the user opens the file in GIMP, the parser writes past the intended memory region.

The consequences depend on which memory is corrupted. Corruption of adjacent heap metadata or function pointers can enable code execution. Corruption of unrelated data can cause application crashes or unpredictable rendering behavior. The CVSS vector indicates local attack scope with required user interaction, reflecting that the target user must open the malicious file.

Root Cause

The root cause is insufficient validation of length and offset fields parsed from PSD and PAA image structures. The plugins trust attacker-supplied sizes when copying image data into internal buffers, allowing writes past the allocated boundary. No prior authentication is required beyond convincing the user to open the file.

Attack Vector

Exploitation requires an attacker to deliver a crafted PSD or PAA file to a target user and convince the user to open it in GIMP. No further interaction is needed once the file is loaded. The attack executes with the privileges of the user running GIMP.

No public proof-of-concept exploit code is currently available. Refer to the Red Hat CVE-2026-59091 Advisory and GNOME GIMP Work Item 16510 for upstream technical details.

Detection Methods for CVE-2026-59091

Indicators of Compromise

Unexpected GIMP process crashes or segmentation faults immediately after opening a PSD or PAA file
PSD or PAA files received from untrusted sources, particularly with unusual header sizes or truncated structures
Child processes spawned by the GIMP binary that do not match expected image-editing workflows
Writes to sensitive filesystem locations or network connections initiated shortly after GIMP opens an image

Detection Strategies

Monitor process telemetry for GIMP crashes correlated with file-open events involving .psd or .paa extensions
Inspect endpoint logs for anomalous child processes launched by gimp or its plugin binaries
Apply file-content inspection at email and web gateways to identify malformed PSD or PAA files with inconsistent length fields

Monitoring Recommendations

Alert on GIMP process termination with abnormal exit codes on user workstations
Track filesystem and network activity originating from the GIMP process tree after image files are opened
Correlate file downloads of PSD or PAA extensions from untrusted domains with subsequent GIMP execution

How to Mitigate CVE-2026-59091

Immediate Actions Required

Restrict opening of PSD and PAA files from untrusted sources until a patched GIMP build is deployed
Apply vendor updates from the affected distribution as soon as they are released
Educate users about the risk of opening unsolicited image files, especially PSD and PAA formats
Deploy endpoint monitoring to detect anomalous behavior originating from the GIMP process

Patch Information

As of the NVD publication date, upstream GIMP is tracking the fix in GNOME GIMP Work Item 16510. Distribution updates are being coordinated through vendor channels. Refer to the Red Hat CVE-2026-59091 Advisory and Red Hat Bug 2496585 Report for package availability and version details.

Workarounds

Avoid opening PSD or PAA files received from untrusted or unverified sources
Preview suspicious image files in a sandboxed or isolated environment before opening them on production endpoints
Configure the desktop environment to prevent GIMP from being registered as the default handler for PSD and PAA files on shared systems
Limit user privileges so that GIMP runs under a standard, non-administrative account