CVE-2026-112259: Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application.
Other sources
A flaw was found in GIMP’s SwatchBooker (SBZ) palette importer. The parser can leave the color model NULL, then still process <values> text and call strcmp(NULL, "srgb") in swatchbookerloadtext(), crashing the main GIMP process (palette import is not plug-in-isolated).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the crash?
The attacker must induce a user to import a crafted SwatchBooker (SBZ) palette file that omits the color-model attribute while still containing <values> text. Exploitation requires user interaction, as reflected by the UI:R vector.
Is this limited to an isolated plug-in process?
No. The SBZ palette importer runs in the main GIMP process rather than in a plug-in-isolated process, so a successful trigger crashes the GIMP application itself.
What is the expected security impact?
The documented impact is denial of service through an application crash. The supplied vector indicates no confidentiality or integrity impact.