Is CVE-2026-90949 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-90949?

CVE-2026-90949 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-90949

Description

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.