CVE-2026-59091
published 2026-08-10CVE-2026-59091: A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.40%
33.7th percentile
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gimp | gimp | — | — |
| gimp | gimp | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file
vendor_redhat·2026-06-15·CVSS 7.3
CVE-2026-59091 [HIGH] CWE-787 gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file
gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.
Statement: This Important vulnerability in GIMP's image file plugins, specifically for PSD and PAA formats, allows for information disclosure or potential arbitrary code execution. It is triggered when a user opens a specially crafted image file, a common user action for image manipulation software. The local nature of the exploit is offset by the significant impact of potenti
GHSA
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files.
ghsa_unreviewed·2026-08-10
CVE-2026-59091 [HIGH] CWE-787 A flaw was found in GIMP's file format plugins, including those for PSD and PAA files.
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59091 gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file [fedora-all]
bugzilla·2026-08-10·CVSS 7.3
CVE-2026-59091 [HIGH] CVE-2026-59091 gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file [fedora-all]
CVE-2026-59091 gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A source-level audit of GIMP's file format plugins identified 2 vulnerabilities in default-install plugins (file-psd, file-paa). Both are triggerable by opening a crafted image file — no user interaction beyond "File > Open" is required. Each finding has been independently reproduced with a standalone PoC and confirmed via AddressSanitizer or arithmetic verification in a Docker environment (Fedora 41, gcc, zlib-devel).
https://gitlab.gnome.org/GNOME/gimp/-/w
Bugzilla
CVE-2026-59091 gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file
bugzilla·2026-07-02·CVSS 7.3
CVE-2026-59091 [HIGH] CVE-2026-59091 gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file
CVE-2026-59091 gimp: GIMP: Multiple vulnerabilities in file format plugins via crafted image file
A source-level audit of GIMP's file format plugins identified 2 vulnerabilities in default-install plugins (file-psd, file-paa). Both are triggerable by opening a crafted image file — no user interaction beyond "File > Open" is required. Each finding has been independently reproduced with a standalone PoC and confirmed via AddressSanitizer or arithmetic verification in a Docker environment (Fedora 41, gcc, zlib-devel).
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16510
2026-08-10
Published