Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-08-10 | 2 | Disclosure2 |
| 2026-08-20 | 1 | Disclosure1 |
| 2026-09-01 | 2 | Disclosure1Patch1 |
GIMP の PSD プラグインに符号なし整数アンダーフロー。細工した .psd を開くと任意コード実行に至ります。見落としやすいのはヘッドレス経路で、画像変換パイプラインに入れていると操作なしでパーサへ届きます。RHEL は RHSA-2026:61587。 https://cve.autoarticles.net/cve/CVE-2026-59090
Post summary
The post details an unsigned integer underflow in GIMP’s PSD plugin that enables arbitrary code execution, notes a headless pipeline access path, and references the RHEL advisory RHSA‑2026:61587 along with a link to the CVE description.
残りバイト数を符号なし整数で持つと、引きすぎたときに 0 を下回らず最大値へ回り込みます。GIMP CVE-2026-59090 はこれで .psd のパーサが読み進めてしまう脆弱性。Node.js で同じ形を再現して、検査を引く前に置く必要がある理由を確かめました。 https://blog.hashito.biz/2026/09/01/gimp-cve-2026-59090-unsigned-integer-underflow-psd/
Post summary
The post discloses a GIMP vulnerability (CVE‑2026‑59090) involving an unsigned integer underflow in the PSD parser, demonstrates the issue in Node.js, and links to a blog article containing further details.
🔴 GIMP, Unsigned Integer Underflow, #CVE-2026-59090 (Critical) -DC-Aug2026-1668 https://dailycve.com/gimp-unsigned-integer-underflow-cve-2026-59090-critical-dc-aug2026-1668/
Post summary
The text announces a new critical unsigned integer underflow vulnerability in GIMP (CVE-2026-59090) but does not provide details about PoC, exploitation, or remediation.
🚨*CVE* CVE-2026-59090 A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially… https://www.cve.org/CVERecord?id=CVE-2026-59090 ----- Traducción: Se encontró una fa… http://infoflow.cloud`
Post summary
A new CVE has been disclosed: GIMP's PSD plugin contains an unsigned integer underflow in the `block_rem` variable; no exploit or patch details are provided yet.
CVE-2026-59090 A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially… https://www.cve.org/CVERecord?id=CVE-2026-59090
Post summary
The text reports a newly discovered unsigned integer underflow flaw in GIMP's PSD file plugin, providing a brief technical description but no evidence of exploitation, PoC, or mitigation.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gimp | gimp | 3.3.1 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |