An update for gimp is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3573 Final 1.0 1.0 2026-08-30 Initial 2026-08-30 2026-08-30 openEuler SA Tool V1.0 2026-08-30 gimp security update An update for gimp is now available for openEuler-24.03-LTS-SP4 The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute. Security Fix(es): A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.(CVE-2026-59090) An update for gimp is now available for master/openEuler-20.03-LTS-SP4/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High gimp https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3573 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59090 https://nvd.nist.gov/vuln/detail/CVE-2026-59090 openEuler-24.03-LTS-SP4 gimp-3.2.4-7.oe2403sp4.aarch64.rpm gimp-debuginfo-3.2.4-7.oe2403sp4.aarch64.rpm gimp-debugsource-3.2.4-7.oe2403sp4.aarch64.rpm gimp-devel-3.2.4-7.oe2403sp4.aarch64.rpm gimp-extension-goat-excercises-3.2.4-7.oe2403sp4.aarch64.rpm gimp-libs-3.2.4-7.oe2403sp4.aarch64.rpm gimp-plugin-aa-3.2.4-7.oe2403sp4.aarch64.rpm gimp-plugin-python3-3.2.4-7.oe2403sp4.aarch64.rpm gimp-vala-3.2.4-7.oe2403sp4.aarch64.rpm gimp-3.2.4-7.oe2403sp4.src.rpm gimp-3.2.4-7.oe2403sp4.x86_64.rpm gimp-debuginfo-3.2.4-7.oe2403sp4.x86_64.rpm gimp-debugsource-3.2.4-7.oe2403sp4.x86_64.rpm gimp-devel-3.2.4-7.oe2403sp4.x86_64.rpm gimp-extension-goat-excercises-3.2.4-7.oe2403sp4.x86_64.rpm gimp-libs-3.2.4-7.oe2403sp4.x86_64.rpm gimp-plugin-aa-3.2.4-7.oe2403sp4.x86_64.rpm gimp-plugin-python3-3.2.4-7.oe2403sp4.x86_64.rpm gimp-vala-3.2.4-7.oe2403sp4.x86_64.rpm A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system. 2026-08-30 CVE-2026-59090 openEuler-24.03-LTS-SP4 High 8.4 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H gimp security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3573