GIMP: Use-after-free in XCF file loader
Summary
A flaw in the GIMP XCF loader causes a use-after-free when a crafted XCF file selects a path and then fails to load it. Successful exploitation can crash the application and potentially lead to arbitrary code execution in the context of the user. The attack requires the user to open a malicious file; no privileges are needed, and GIMP is not a network-facing service.
Affected
- Red Hat Enterprise Linux 9 (gimp)
- Red Hat Enterprise Linux 10 (gimp)
- Red Hat Enterprise Linux 6, 7 and 8: not affected according to the Red Hat CVE record
Fixed in
Unknown. No fixed package has been confirmed yet.
Workaround
- Avoid opening untrusted XCF files in GIMP.
- If GIMP is not needed, remove the gimp package.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS score 0.00136 (very low).
- No public proof of concept found.
Our recommendation
- Identify systems with GIMP installed, especially RHEL 9 and RHEL 10.
- Remove GIMP where it is not required.
- Instruct users not to open XCF files from unknown sources until a fixed package is installed.
- Apply the Red Hat erratum for gimp as soon as it is released and monitor the CVE page.
- Severity: CVSS 3.1 base score 7.8 per Red Hat and cve.org; NVD analysis is pending and some sources list a lower score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-112261 access.redhat.com
- Red Hat Bugzilla 2555748 bugzilla.redhat.com
- OpenCVE CVE-2026-112261 app.opencve.io
- Ubuntu security CVE-2026-112261 ubuntu.com
- VulDB 422548 vuldb.com
- Debian tracker action item 3028136 tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:38.
Original description (NVD)
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.