External risk intelligence

GIMP PSD File Parsing Vulnerability Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-59090

The vulnerability exists in a local image processing application (GIMP) and requires a user to manually open a specially crafted PSD file. It is a client-side file parsing issue that is not internet-facing, does not provide network services, and is not an edge or gateway component.

Gimp

3.3.17.08.09.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in GIMP's PSD file handling could allow an attacker to execute arbitrary code by tricking a user into opening a specially crafted image file. This flaw affects how the software interprets image data, potentially leading to system compromise. The main concern is confirming if your environment uses this software and could be exposed.

Flaw allows code execution via crafted image files.
Matters if GIMP is used for opening PSD images.
Confirm relevance and any potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into opening a specially crafted PSD image file. This would trigger a flaw in GIMP's PSD file parsing, allowing the attacker to inject malicious code that could then be executed on the user's system.

Requires user to open malicious file.
Flaw triggered by parsing PSD file.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in GIMP's PSD file plugin could allow an attacker to execute arbitrary code on a user's system when they open a specially crafted `.psd` image file. This occurs due to an integer underflow that leads to parser confusion, enabling the injection of malicious data.

System code execution.
Opening malicious PSD file.
Arbitrary code execution on system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts GIMP users who open specially crafted PSD files, potentially leading to arbitrary code execution. Ownership likely resides with application owners and potentially infrastructure teams managing the GIMP deployment. The immediate priority is to identify all GIMP instances, assess user exposure to untrusted PSD files, and plan remediation or risk reduction measures.

Application owners should manage this issue.
Verify user exposure to untrusted PSD files.
Plan remediation within maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GIMP and why does it use PSD files?

GIMP, or the GNU Image Manipulation Program, is an open-source tool used for photo editing, image composition, and retouching. While it uses its own file format, GIMP includes specialized plugins to support interoperability with other software, such as Adobe Photoshop. The PSD plugin allows users to import, edit, and export Photoshop files, making it a common choice for designers who need to work across different professional imaging platforms.

What is the vulnerability behind CVE-2026-59090?

This vulnerability is classified as an unsigned integer underflow (CWE-191). In plain terms, the software makes a calculation error while reading the size of specific data blocks within a PSD file. Because the number becomes smaller than the system expects, it confuses the parser. This logic error allows an attacker to bypass standard safeguards and insert their own data into the system's memory, which can eventually lead to unauthorized code execution.

How is this GIMP vulnerability triggered?

The flaw is triggered when a user manually opens a malicious PSD file within the GIMP application. It is important to note that simply having the software installed or receiving a file does not trigger the bug; the parsing process must be actively initiated by the user. If a PSD file is well-formed and follows standard specifications, the underflow condition does not occur, and the file remains safe to process.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that the risk is very unlikely for most environments. Because GIMP is a local client-side application and not an internet-facing network service, it does not provide an entry point for remote attackers to scan or exploit. The vulnerability requires direct user interaction, meaning it is not an edge or gateway component that can be compromised from the network without the user's involvement.

What should I do if I use GIMP on my workstation?

Your first step is to confirm whether your workflow requires opening PSD files from untrusted or unknown sources. Since the vulnerability is tied to the PSD parsing plugin, verify if your current version of GIMP is affected and check for available updates from your distribution or the vendor. In the meantime, exercise caution by only opening PSD files that originate from known, trusted creators to minimize the potential for exposure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.