CVE-2026-59091 is a vulnerability in GIMP's file format plugins for PSD and PAA files. A remote attacker can exploit this by tricking a user into opening a crafted image file, leading to memory corruption that may result in information disclosure or arbitrary code execution. The flaw involves out-of-bounds write conditions (CWE-787) that can modify control data such as return addresses. The attack requires local user interaction but no elevated privileges. The vulnerability affects numerous specific GIMP versions, primarily those distributed in various Ubuntu packages. The CVSS 3.1 base score is 7.8 (high), reflecting high confidentiality, integrity, and availability impacts with low attack complexity and required privileges.

Successful exploitation can lead to information disclosure, arbitrary code execution, and denial of service via application crashes. The vulnerability arises from out-of-bounds write operations in file format plugins, potentially allowing an attacker to execute unauthorized code or cause the application to enter an unexpected state. The attack vector requires a user to open a malicious image file, but no further user interaction or elevated privileges are needed. This can compromise system integrity and availability.

No official fix or patch links are provided in the input data. Users are advised to avoid opening untrusted or suspicious image files, especially in PSD or PAA formats, with GIMP. Exercising caution with files from unknown sources is the primary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.