CVE-2026-59091: 
Linux Debian 脆弱性の分析と軽減

CVE-2026-59091 is a high-severity out-of-bounds write vulnerability affecting GIMP's file format plugins, specifically the file-psd and file-paa plugins. A remote attacker can exploit this flaw by tricking a user into opening a specially crafted PSD or PAA image file, potentially leading to unexpected application behavior, information disclosure, or arbitrary code execution. The vulnerability was reported on July 2, 2026, and publicly disclosed on August 10, 2026. It carries a CVSS v3.1 base score of 7.3 (High), assigned by Red Hat as the CNA (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write), where GIMP's file format parsing code writes data beyond the bounds of an allocated buffer when processing malformed PSD or PAA image files. According to the Red Hat Bugzilla report, a source-level audit identified two vulnerabilities in default-install plugins (file-psd, file-paa), both independently reproduced with standalone proof-of-concept code and confirmed via AddressSanitizer in a Fedora 41 Docker environment. Exploitation requires only that the victim perform a standard "File > Open" action — no additional user interaction beyond opening the file is needed. The attack vector is local (the file must be opened on the victim's system), requires low privileges, and low attack complexity (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can result in high confidentiality, integrity, and availability impact on the affected system. An attacker who tricks a user into opening a malicious PSD or PAA file in GIMP could achieve arbitrary code execution with the privileges of the user running GIMP, access sensitive files readable by that user, or crash the application. Red Hat classifies this as an "Important" vulnerability capable of enabling information disclosure or potential arbitrary code execution (Red Hat Advisory).

As of the disclosure date (August 10, 2026), there is no evidence of public proof-of-concept exploit code being released or active in-the-wild exploitation. However, the Red Hat Bugzilla entry notes that standalone PoC files were developed internally and used to confirm the vulnerabilities during the audit. The EPSS score is 0.0, indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (Red Hat Bugzilla, Github Advisory).

1. Craft a malicious image file: Create a specially crafted PSD or PAA image file that triggers the out-of-bounds write condition in GIMP's file-psd or file-paa plugin by embedding malformed data in the file structure.
2. Deliver the file to the target: Distribute the crafted image via email attachment, file sharing platform, web download, or social engineering to a user who has GIMP installed.
3. Induce the victim to open the file: Trick the user into opening the file in GIMP (e.g., by disguising it as a legitimate design asset or screenshot), which requires only a standard "File > Open" action.
4. Trigger the vulnerability: Upon parsing the malformed file, GIMP's plugin writes data out of bounds, potentially corrupting memory in a way that leads to application crash, information disclosure, or arbitrary code execution with the victim user's privileges (Red Hat Bugzilla, Red Hat Advisory).

• File System: Presence of unexpected or suspicious .psd or .paa files in user download directories, temporary folders, or email attachment staging areas.
• Process: GIMP process (gimp, gimp-2.x) crashing unexpectedly or spawning unusual child processes (e.g., shell interpreters, network utilities) after opening an image file.
• Logs: Application crash logs or core dumps associated with the GIMP process, particularly referencing file-psd or file-paa plugin modules; AddressSanitizer-style memory error output if GIMP is compiled with sanitizers.
• Network: Unexpected outbound network connections originating from the GIMP process following the opening of an image file, which may indicate post-exploitation activity.

A patch has been made available; users should update GIMP to the patched version as soon as it is distributed by their vendor or the GIMP project. Red Hat advises users to avoid opening untrusted image files, particularly those in PSD or PAA formats, with GIMP, and to exercise caution with files from unknown or suspicious sources. As an additional control, organizations can implement application allowlisting or file type restrictions to limit which image formats users can open in GIMP. The GNOME/GIMP project issue tracking the fix is available at the upstream work item (Red Hat Advisory, Github Advisory).