REDHAT-BUG-2555588: High severity GIMP GIMP XCF loader vulnerability
A flaw was found in the GIMP XCF loader. Marking a channel as linked (PROPLINKED) stores a raw pointer in linkedchannels. A later PROPSELECTION on the same channel can destroy the object without removing that pointer. At end of load, gimpitemlistnamednew() dereferences the dangling pointer. The CVE-2025-14424 NULL guard does not stop a non-NULL dangling pointer, so this is an incomplete-fix bypass requiring a separate CVE. Reporters demonstrated reclaim of the freed block with attacker-controlled bytes.
Affected Software
Event History
Frequently Asked Questions
Does applying the fix for CVE-2025-14424 address this issue?
No. The described flaw bypasses the CVE-2025-14424 NULL guard because the stale linked_channels entry is a non-NULL dangling pointer.
What attacker-controlled condition is involved in exploitation?
Reporters demonstrated that the freed memory block can be reclaimed with attacker-controlled bytes before the XCF loader dereferences the stale pointer at the end of loading.
Which loading sequence triggers the stale pointer?
A channel is first marked linked with PROP_LINKED, then receives PROP_SELECTION. The later property can destroy the channel without removing its raw pointer from linked_channels.