CVE-2026-112260: Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
A flaw was found in GIMP XCF text-layer handling. Parasite payloads can be stored as exact file-sized heap copies without a NUL terminator, then processed with unbounded C-string APIs in gimptextfromparasite(). This over-reads heap memory in the main process; leaked bytes can appear as layer text / errors and persist into a re-saved XCF. A crafted file can also crash GIMP.
Other sources
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.2.8-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
GIMP users who open crafted XCF files with malformed text-layer parasites are exposed. Exploitation requires user interaction to open the malicious file.
What does an attacker need to do to trigger the flaw?
An attacker needs to provide a crafted XCF containing a malformed text-layer parasite and have it opened in GIMP. No attacker privileges are required according to the supplied severity vector.
What are signs that a file may have triggered the issue?
Unexpected content may appear in layer text or error messages, and GIMP may crash while handling the file. If the document is re-saved, leaked bytes may persist into the resulting XCF.