---
id: CVE-2026-59091
title: >-
  Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image
  file
summary: >-
  A flaw was found in GIMP's file format plugins, including those for PSD and
  PAA files. A remote attacker could exploit these vulnerabilities by tricking a
  user into opening a specially crafted image file. This could lead to
  unexpected ap…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Red Hat
product: gimp
affected:
  - gimp 3.2.6
  - gimp
  - gimp
  - gimp
  - gimp
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-11T03:55:40.357140Z'
published: '2026-08-10'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T23:07:27.686Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59091'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59091'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496585'
    label: RHBZ#2496585
  - url: 'https://gitlab.gnome.org/GNOME/gimp/-/work_items/16510'
tags:
  - cve.org
epss: 0.00405
epssPercentile: 0.35015
ingestedAt: '2026-11-05T21:36:00.670Z'
---

## Overview

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.

## Affected

- `gimp 3.2.6`
- `gimp`
- `gimp`
- `gimp`
- `gimp`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Users should avoid opening untrusted image files, particularly those in PSD or PAA formats, with GIMP. Exercising caution with files from unknown or suspicious sources can prevent exploitation of these vulnerabilities.