by Kastro CVE-2026-59090
Red Hat Red Hat Enterprise Linux 9 — Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow
Description · from the CVE record
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Affected
ProductAffectedFixed inSource
gimp3.3.1–CNA
Red Hat Enterprise Linux 9see advisory2:3.0.4-4.el9_8.10CNA
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionssee advisory2:2.99.8-4.el9_4.19CNA
Red Hat Enterprise Linux 9.6 Extended Update Supportsee advisory2:2.99.8-4.el9_6.20CNA
Red Hat Enterprise Linux 6see advisory–CNA
Red Hat Enterprise Linux 7see advisory–CNA
Red Hat Enterprise Linux 8see advisory–CNA
Scores by source
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
redhat (CNA)8.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total