Skip to main content

GIMP EUVDEUVD-2026-55732

| CVE-2026-59091 HIGH
Out-of-bounds Write (CWE-787)
2026-08-10 redhat GHSA-47q2-mm4c-pmpc
7.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
HIGH
qualitative
NVD
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

File parsed locally by user-launched GIMP process; no network vector, no privilege required, but user must open file.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Aug 19, 2026 - 20:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 19, 2026 - 20:22 vuln.today
cvss_changed
CVSS changed
Aug 19, 2026 - 20:22 NVD
7.3 (HIGH) 7.8 (HIGH)
Analysis Generated
Aug 10, 2026 - 19:29 vuln.today
CVE Published
Aug 10, 2026 - 18:48 nvd
HIGH 7.3

DescriptionNVD

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.

AnalysisAI

Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.

Technical ContextAI

GIMP implements file format support through discrete plugins, including parsers for Adobe Photoshop (PSD) and PAA image formats. CWE-787 (Out-of-bounds Write) indicates that malformed image data causes the plugin to write memory beyond an allocated buffer boundary - a classic memory corruption class tied to insufficient bounds checking during parsing of attacker-controlled file structures such as layer records, channel descriptors, or palette data. The CPE strings cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through 9 confirm that GIMP as packaged and distributed by Red Hat across its major RHEL releases is the affected delivery vehicle. The CVSS vector AV:L reflects that exploitation requires the file to be processed on the victim's local system, while UI:R captures the social engineering precondition of convincing the user to open the file.

RemediationAI

The primary remediation is to apply updated GIMP packages from Red Hat once available for the affected RHEL release; monitor https://access.redhat.com/security/cve/CVE-2026-59091 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2496585 for patched package announcements. No specific fixed version has been confirmed in available data, so a vendor-released patch should not be assumed available. As a compensating control, restrict or disable GIMP's PSD and PAA plugin processing in environments where handling of untrusted image files is not required, though disabling these plugins may break legitimate workflows for graphic artists. User-awareness measures - instructing staff not to open image files from untrusted sources - reduce the social-engineering surface but cannot substitute for patching. GIMP's AppArmor or SELinux confinement profiles on RHEL can limit the blast radius of exploitation by constraining the process's filesystem and network access even if a memory corruption exploit succeeds.

CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-59090 CRITICAL
9.9 Aug 10

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens

CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Workstation Extension 15 SP7 Not-Affected

Share

EUVD-2026-55732 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy