A flaw was found in the GIMP XCF loader. Marking a channel as linked (PROPLINKED) stores a raw pointer in linkedchannels. A later PROPSELECTION on the same channel can destroy the object without removing that pointer. At end of load, gimpitemlistnamednew() dereferences the dangling pointer. The CVE-2025-14424 NULL guard does not stop a non-NULL dangling pointer, so this is an incomplete-fix bypass requiring a separate CVE. Reporters demonstrated reclaim of the freed block with attacker-controlled bytes.