{
  "cveId": "CVE-2026-59090",
  "url": "https://patchblox.com/security/cve/CVE-2026-59090",
  "summary": "CVE-2026-59090 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-59090, released August 28, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "gimp: A flaw was found in GIMP\u0027s PSD file format plugin",
  "description": "A flaw was found in GIMP\u0027s PSD file format plugin. This vulnerability, an unsigned integer underflow in the \u0060block_rem\u0060 variable, occurs when a user opens a specially crafted \u0060.psd\u0060 image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim\u0027s system.",
  "published": "2026-08-10T13:19:51Z",
  "severity": "critical",
  "cvss": 9.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.0076,
  "epssPercentile": 0.5554,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "gimp",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.0.4-3\u002Bdeb13u10",
      "fix": "DEBIAN-CVE-2026-59090",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59090",
      "released": "2026-08-28T00:36:15Z"
    },
    {
      "platform": "linux",
      "product": "gimp",
      "release": "Debian 14",
      "fixedVersion": "3.2.6-1",
      "fix": "DEBIAN-CVE-2026-59090",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59090",
      "released": "2026-08-28T00:36:15Z"
    },
    {
      "platform": "linux",
      "product": "gimp",
      "release": "RHEL 9",
      "fixedVersion": "2:3.0.4-4.el9_8.10",
      "fix": "RHSA-2026:61587",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61587",
      "released": "2026-09-13T12:47:53Z"
    },
    {
      "platform": "linux",
      "product": "gimp",
      "release": "almalinux 9",
      "fixedVersion": "2:3.0.4-4.el9_8.10",
      "fix": "ALSA-2026:61587",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61587",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gimp",
      "release": "ol 9",
      "fixedVersion": "2:3.0.4-4.el9_8.10",
      "fix": "ELSA-2026-61587-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61587-0",
      "released": "2026-09-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gimp",
      "release": "sles 15.7",
      "fixedVersion": "2.10.30-150400.3.74.1",
      "fix": "SUSE-SU-2026:4309-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4309-1",
      "released": "2026-09-23T13:18:47Z"
    },
    {
      "platform": "linux",
      "product": "gimp-libs",
      "release": "RHEL 9",
      "fixedVersion": "2:3.0.4-4.el9_8.10",
      "fix": "RHSA-2026:61587",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61587",
      "released": "2026-09-13T12:47:53Z"
    },
    {
      "platform": "linux",
      "product": "gimp-libs",
      "release": "almalinux 9",
      "fixedVersion": "2:3.0.4-4.el9_8.10",
      "fix": "ALSA-2026:61587",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61587",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gimp-libs",
      "release": "ol 9",
      "fixedVersion": "2:3.0.4-4.el9_8.10",
      "fix": "ELSA-2026-61587-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61587-0",
      "released": "2026-09-01T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}