GIMP: Use-after-free in XCF file loader
Summary
GIMP, an image editing program, contains a use-after-free flaw in its XCF file loader. A dangling pointer in the linked-channels list can be triggered when a linked channel is destroyed via a selection property. An attacker who gets a user to open a crafted XCF file can crash GIMP and potentially execute arbitrary code with the user's privileges.
Affected
- GIMP (GNU Image Manipulation Program), all versions as far as known; exact affected versions are unknown.
- Red Hat Enterprise Linux 9 and 10: Affected (per Red Hat CVE page).
- Red Hat Enterprise Linux 6, 7 and 8: Not affected (per Red Hat CVE page).
- Debian bookworm, trixie and forky: vulnerable (per Debian tracker).
- Ubuntu: status 'Needs evaluation' for supported releases.
- Windows and macOS builds: Unknown.
Fixed in
Unknown. No vendor fix or patched package has been identified at the time of writing.
Workaround
- Avoid opening untrusted XCF files in GIMP until an update is available.
- If GIMP is not needed, remove the gimp package.
Exploitation
- CISA SSVC: Exploitation none, not automatable, total technical impact.
- Not listed as known exploited (KEV: No).
- EPSS 0.00136, a low predicted exploitation probability.
- No public proof of concept found; this does not confirm that none exists.
Our recommendation
- Identify GIMP installations on Linux hosts and workstations, including any Windows or macOS installs.
- Restrict GIMP use to trusted XCF files, and remove GIMP where it is not required.
- Warn staff not to open XCF files from unknown senders, email attachments or untrusted downloads.
- Apply vendor updates as soon as they are published and re-check the Red Hat advisory and Debian tracker.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-112258 access.redhat.com
- Red Hat Bugzilla 2555588 bugzilla.redhat.com
- Debian Security Tracker: gimp security-tracker.debian.org
- Ubuntu Security: CVE-2026-112258 ubuntu.com
- Red Hat Errata RHSA-2026:0914 access.redhat.com
- HOL Guard: CVE-2026-112258 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:37.
Original description (NVD)
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.