CVE-2026-112261: Gimp: gimp: use-after-free in xcf loader via prop_selected_path
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
Other sources
A flaw was found in the GIMP XCF loader. PROPSELECTEDPATH stores a raw pointer in the selected-paths list. If path parsing later fails, the object is destroyed without removing that pointer. End-of-load gimpimagesetselectedpaths() then dereferences the dangling pointer. Reporters demonstrated reclaim with attacker-controlled file bytes.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
GIMP users are exposed when they open a crafted XCF file. The CVSS vector indicates local attack access, no required privileges, and required user interaction.
What could exploitation allow?
Successful exploitation can crash the GIMP main process and may allow arbitrary code execution. The reported impact includes high confidentiality, integrity, and availability effects.
What condition triggers the vulnerable code path?
The XCF must select a path and subsequently fail while loading that path. The failure leaves a dangling selected-path pointer that is later dereferenced at the end of image loading.