CVE-2026-112258: Use After Free
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
Other sources
A flaw was found in the GIMP XCF loader. Marking a channel as linked (PROPLINKED) stores a raw pointer in linkedchannels. A later PROPSELECTION on the same channel can destroy the object without removing that pointer. At end of load, gimpitemlistnamednew() dereferences the dangling pointer. The CVE-2025-14424 NULL guard does not stop a non-NULL dangling pointer, so this is an incomplete-fix bypass requiring a separate CVE. Reporters demonstrated reclaim of the freed block with attacker-controlled bytes.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Does the NULL-pointer guard introduced for CVE-2025-14424 protect against this issue?
No. The guard does not prevent dereference of a non-NULL dangling pointer, so this flaw is an incomplete-fix bypass that requires separate remediation.
What access does an attacker need to trigger the vulnerability?
The attacker needs to persuade a user to open a crafted XCF file in GIMP. The CVSS vector indicates local attack access, no required privileges, and required user interaction.