Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by redhat

CVE-2026-112261Gimp: gimp: use-after-free in xcf loader via prop_selected_path

High 7.8

In plain English

A high-severity use-after-free in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 93.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gimp2:3.0.4-4.el9_8.15ALSA-2026:93975
AlmaLinux:9gimp-libs2:3.0.4-4.el9_8.15ALSA-2026:93975
Debian:12gimpno fix listedDEBIAN-CVE-2026-112261
Debian:13gimpno fix listedDEBIAN-CVE-2026-112261
Debian:14gimpno fix listedDEBIAN-CVE-2026-112261
Ubuntu:26.04:LTSgimpno fix listedUBUNTU-CVE-2026-112261
Ubuntu:26.10gimpno fix listedUBUNTU-CVE-2026-112261

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References