Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File parsed locally by user-launched GIMP process; no network vector, no privilege required, but user must open file.
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.
AnalysisAI
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Technical ContextAI
GIMP implements file format support through discrete plugins, including parsers for Adobe Photoshop (PSD) and PAA image formats. CWE-787 (Out-of-bounds Write) indicates that malformed image data causes the plugin to write memory beyond an allocated buffer boundary - a classic memory corruption class tied to insufficient bounds checking during parsing of attacker-controlled file structures such as layer records, channel descriptors, or palette data. The CPE strings cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through 9 confirm that GIMP as packaged and distributed by Red Hat across its major RHEL releases is the affected delivery vehicle. The CVSS vector AV:L reflects that exploitation requires the file to be processed on the victim's local system, while UI:R captures the social engineering precondition of convincing the user to open the file.
RemediationAI
The primary remediation is to apply updated GIMP packages from Red Hat once available for the affected RHEL release; monitor https://access.redhat.com/security/cve/CVE-2026-59091 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2496585 for patched package announcements. No specific fixed version has been confirmed in available data, so a vendor-released patch should not be assumed available. As a compensating control, restrict or disable GIMP's PSD and PAA plugin processing in environments where handling of untrusted image files is not required, though disabling these plugins may break legitimate workflows for graphic artists. User-awareness measures - instructing staff not to open image files from untrusted sources - reduce the social-engineering surface but cannot substitute for patching. GIMP's AppArmor or SELinux confinement profiles on RHEL can limit the blast radius of exploitation by constraining the process's filesystem and network access even if a memory corruption exploit succeeds.
More in Red Hat Enterprise Linux 6
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP4 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Not-Affected |
| openSUSE Leap 15.4 | Not-Affected |
| openSUSE Leap 15.5 | Not-Affected |
| openSUSE Leap 15.6 | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-55732
GHSA-47q2-mm4c-pmpc