Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by redhat

CVE-2026-112258Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

High 7.8

In plain English

A high-severity use-after-free in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 93.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gimp2:3.0.4-4.el9_8.15ALSA-2026:93975
AlmaLinux:9gimp-libs2:3.0.4-4.el9_8.15ALSA-2026:93975
Debian:12gimpno fix listedDEBIAN-CVE-2026-112258
Debian:13gimpno fix listedDEBIAN-CVE-2026-112258
Debian:14gimpno fix listedDEBIAN-CVE-2026-112258
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-112258
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-112258

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References