CVE-2026-59090 is an unsigned integer underflow vulnerability in the block_rem variable of GIMP's PSD file format plugin. When a user opens a maliciously crafted .psd file, the underflow causes parser confusion that allows injection of arbitrary data as layer resource blocks. This can lead to arbitrary code execution on the affected system. The vulnerability affects Red Hat Enterprise Linux 6 where GIMP is installed. The CVSS v3.1 score is 8.4 (High), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or fix status is provided in the vendor advisory, but mitigation involves avoiding untrusted PSD files.

Successful exploitation can lead to arbitrary code execution, allowing attackers to run malicious code on the victim's system. The vulnerability impacts confidentiality, integrity, and availability, with potential for system crashes or instability due to the integer underflow. The attack requires low privileges and no user interaction but has high attack complexity. This primarily affects desktop environments processing untrusted PSD files with GIMP.

Red Hat's advisory recommends avoiding opening untrusted or suspicious PSD image files with GIMP to mitigate this vulnerability. No official patch or fix has been confirmed yet. Users should follow vendor guidance and monitor the Red Hat advisory for updates regarding patches or official fixes.