CVE-2026-59091

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.

• CWE-787

• https://access.redhat.com/security/cve/CVE-2026-59091Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2496585Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/gimp/-/work_items/16510Exploit, Mitigation, Vendor Advisory

Published

Aug 10, 2026

Last Modified

Aug 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59086A vulnerability has been identified in Simcenter Femap (All …7.8
• CVE-2026-59087A flaw was found in the GIMP image manipulation program, spe…7.8
• CVE-2026-59088A flaw was found in GIMP. A signed integer overflow vulnerab…5.5
• CVE-2026-59089A flaw was found in GIMP. The PlayStation TIM loader, respon…5.5
• CVE-2026-5909Integer overflow in Media in Google Chrome prior to 147.0.77…8.8
• CVE-2026-59090A flaw was found in GIMP's PSD file format plugin. This vuln…9.9
• CVE-2026-59092JuiceFS through 1.3.1, fixed in commit a46979c, contains an …9.8
• CVE-2026-59093Weaviate before 1.38.0 does not verify that a principal perf…8.8
• CVE-2026-59094Pathway through 0.31.1, fixed in commit d09722e, document st…8.7
• CVE-2026-59095LobeChat before 2.2.10-canary.18 contains a server-side requ…8.3
• CVE-2026-59096Dapr Sentry's OIDC discovery endpoint derives the issuer and…8.2
• CVE-2026-59097Taiga before 6.10.2 contains a missing authorization vulnera…6.9