CVE-2026-59090 is an unsigned integer underflow vulnerability in the block_rem variable of GIMP's PSD file format plugin. When a user opens a maliciously crafted .psd image file, the underflow leads to parser confusion, allowing an attacker to inject arbitrary data as layer resource blocks. This can result in arbitrary code execution, enabling the attacker to run malicious code on the victim's system. The vulnerability affects numerous specific GIMP versions distributed in Ubuntu and related environments. The vulnerability has a high CVSS v3.1 score of 9.9, indicating critical impact if exploited. The flaw primarily impacts desktop environments where GIMP processes untrusted PSD files.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the victim's system by opening a specially crafted PSD file in GIMP. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability can lead to full system compromise in environments where GIMP is used to process untrusted PSD images.

No official patch or fix is explicitly stated in the provided advisory. Users should mitigate this vulnerability by avoiding opening untrusted or suspicious PSD image files with GIMP. Only process PSD files from trusted sources. Monitor vendor advisories for updates or patches addressing this issue.