CVE-2026-59090

The unsigned integer underflow in GIMP's PSD parser (`block_rem`) creates more than a parsing error—it shifts the parser into a state where loop conditions permit unbounded reading past intended file boundaries. When `block_rem` underflows to maximum unsigned value, the parser sees remaining bytes as effectively infinite and continues interpreting subsequent file bytes as valid layer resource block structures. This transforms the underflow from a crash condition into a controlled data injection channel. The exploitation path runs through the layer resource block handler dispatch mechanism. Once the parser is processing attacker-injected data as legitimate blocks, the block type identifiers and length fields reach dispatcher functions that were never designed to receive untrusted input. This is where code execution becomes plausible—handler functions may trigger allocations (enabling heap manipulation), copies (increasing use-after-free windows), or pass parameters to subsequent parsing routines that execute on attacker-controlled data. The immediate fix is the dual-check pattern: validate `block_rem > 0` as the loop condition AND confirm that incoming block header sizes won't exceed `block_rem` before decrementing. This creates two independent failure paths—the parser fails safely either when no bytes remain or when a claimed block size exceeds available buffer. Adding only the first check without the size validation leaves the injection channel intact. The CVSS 8.4 score implies the scoring authority saw a clear execution path, but the actual reliability across GIMP versions and memory allocator configurations remains uncertain. The handler dispatch table should be audited for follow-on vulnerabilities reachable through this injection primitive—this is a narrow technical fix but potentially broader structural exposure.

Reviewed through automated stages and approved by a human before publication.