REDHAT-BUG-2555748: High severity GIMP GIMP vulnerability
Published Oct 19, 2026
·Updated
A flaw was found in the GIMP XCF loader. PROPSELECTEDPATH stores a raw pointer in the selected-paths list. If path parsing later fails, the object is destroyed without removing that pointer. End-of-load gimpimagesetselectedpaths() then dereferences the dangling pointer. Reporters demonstrated reclaim with attacker-controlled file bytes.
Affected Software
1 affected component
GIMP GIMP
Event History
Oct 19, 2026
Data Sourced
via Red Hat·06:19 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker control to trigger the reported condition?
The attacker needs control of XCF file bytes such that path parsing fails during loading. The report states that controlled file bytes were used to reclaim the freed object memory before the dangling pointer is dereferenced.