CVE-2026-59090 is an unsigned integer underflow vulnerability in the block_rem variable of GIMP's PSD file format plugin. When a user opens a maliciously crafted .psd image file, the underflow causes the parser to misinterpret data, enabling injection of arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing attackers to execute malicious code on affected systems running Red Hat Enterprise Linux 6 with GIMP installed. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and scope change. Red Hat's advisory recommends avoiding untrusted PSD files as a mitigation. No official patch or fix status is confirmed in the advisory at this time.

Successful exploitation allows an attacker to execute arbitrary code on the victim's system by exploiting an integer underflow in the PSD plugin of GIMP. This can compromise system integrity and availability. The vulnerability affects confidentiality to a low degree but has high impact on integrity and availability. It primarily affects desktop environments where GIMP processes untrusted PSD files.

Red Hat's advisory recommends users avoid opening untrusted or suspicious PSD image files with GIMP to mitigate this vulnerability. There is no official fix or patch currently confirmed by Red Hat. Users should follow vendor guidance and monitor the Red Hat advisory for updates on patch availability.