CVE-2016-4994
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows...
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- Record
CVE-2016-4994- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- Record
CVE-2016-4994- Updated
- 2026-11-02
EUVDEUVD-2016-5959 No score
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- Record
EUVD-2016-5959- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-94h5-f27v-4pc3
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows...
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- Record
GHSA-94h5-f27v-4pc3- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- Record
CVE-2016-4994- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-4994
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- Record
DEBIAN-CVE-2016-4994- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2016:2589
Red Hat Security Advisory: gimp security, bug fix, and enhancement update
- Record
RHSA-2016:2589- CVSS 3.0
- 2.5 Low
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-4994
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- Record
UBUNTU-CVE-2016-4994- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0241 No score
Updated gimp packages fix security vulnerability
It was discovered that there was a use-after-free vulnerability in the channel and layer properties parsing process in GIMP (CVE-2016-4994).
- Record
MGASA-2016-0241- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10294-1 No score
gimp-2.8.18-1.4 on GA media
These are all security issues fixed in the gimp-2.8.18-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10294-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1827-1 No score
Security update for gimp
gimp was updated to fix one security issue.
This security issue was fixed:
- CVE-2016-4994: Use-after-free vulnerabilities in the channel and layer properties parsing process (bsc#986021).
- Record
SUSE-SU-2016:1827-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1962-1 No score
Security update for gimp
gimp was updated to fix one security issue.
This security issue was fixed:
- CVE-2016-4994: Use-after-free vulnerabilities in the channel and layer properties parsing process (bsc#986021).
- Record
SUSE-SU-2016:1962-1- Updated
- 2026-11-02
OSVUSN-3025-1 No score
gimp vulnerability
It was discovered that GIMP incorrectly handled malformed XCF files. If a user were tricked into opening a specially crafted XCF file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.
- Record
USN-3025-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:12 |
before 2.8.16-2.2 | 2.8.16-2.2 |
gimpDebian:13 |
before 2.8.16-2.2 | 2.8.16-2.2 |
gimpDebian:14 |
before 2.8.16-2.2 | 2.8.16-2.2 |
gimpDebian:7 |
before 2.8.2-2+deb7u2, plus listed versions 2.8.2-22.8.2-2+deb7u1 |
2.8.2-2+deb7u2 |
gimpDebian:8 |
before 2.8.14-1+deb8u1, plus listed versions 2.8.14-1 |
2.8.14-1+deb8u1 |
gimpMageia:5 |
before 2.8.14-4.1.mga5 | 2.8.14-4.1.mga5 |
gimp-debuginfoRed Hat:enterprise_linux:7::client |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-develRed Hat:enterprise_linux:7::client |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-devel-toolsRed Hat:enterprise_linux:7::client |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-help-caRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
Show 72 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gimp-help-daRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-deRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-elRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-en_GBRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-esRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-frRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-itRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-jaRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-koRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-nlRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-nnRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-pt_BRRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-ruRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-slRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-svRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-zh_CNRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimpRed Hat:enterprise_linux:7::client |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-helpRed Hat:enterprise_linux:7::client |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-libsRed Hat:enterprise_linux:7::client |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimpRed Hat:enterprise_linux:7::server |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-debuginfoRed Hat:enterprise_linux:7::server |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-develRed Hat:enterprise_linux:7::server |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-devel-toolsRed Hat:enterprise_linux:7::server |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-help-caRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-daRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-deRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-elRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-en_GBRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-esRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-frRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-itRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-jaRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-koRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-nlRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-nnRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-pt_BRRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-ruRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-slRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-svRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-zh_CNRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-libsRed Hat:enterprise_linux:7::server |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-helpRed Hat:enterprise_linux:7::server |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-debuginfoRed Hat:enterprise_linux:7::workstation |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-develRed Hat:enterprise_linux:7::workstation |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-devel-toolsRed Hat:enterprise_linux:7::workstation |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-help-caRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-daRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-deRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-elRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-en_GBRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-esRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-frRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-itRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-jaRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-koRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-nlRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-nnRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-pt_BRRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-ruRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-slRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-svRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-help-zh_CNRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimpRed Hat:enterprise_linux:7::workstation |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimp-helpRed Hat:enterprise_linux:7::workstation |
before 0:2.8.2-1.el7 | 0:2.8.2-1.el7 |
gimp-libsRed Hat:enterprise_linux:7::workstation |
before 2:2.8.16-3.el7 | 2:2.8.16-3.el7 |
gimpSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.6.2-3.34.47.1 | 2.6.2-3.34.47.1 |
gimpSUSE:Linux Enterprise Desktop 12 SP1 |
before 2.8.10-7.8 | 2.8.10-7.8 |
gimpSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.8.10-7.8 | 2.8.10-7.8 |
gimpSUSE:Linux Enterprise Workstation Extension 12 SP1 |
before 2.8.10-7.8 | 2.8.10-7.8 |
gimpUbuntu:14.04:LTS |
before 2.8.10-0ubuntu1.1, plus listed versions 2.8.6-1ubuntu12.8.6-1ubuntu22.8.6-1ubuntu32.8.10-0ubuntu1 |
2.8.10-0ubuntu1.1 |
gimpUbuntu:16.04:LTS |
before 2.8.16-1ubuntu1.1, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu1 |
2.8.16-1ubuntu1.1 |
gimpopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 2.8.18-1.4 | 2.8.18-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4994 is a high vulnerability (CVSS 7.8) in Gimp, published June 24, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.11%, the 87th percentile. Fixed in gimp 2.8.16-2.2.
References
securitytracker.com/id/1036226
git.gnome.org/browse/gimp/commit?id=e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f
bugzilla.gnome.org/show_bug.cgi?id=767873
lists.opensuse.org/opensuse-updates/2016-07/msg00005.html
securityfocus.com/bid/91425
debian.org/security/2016/dsa-3612
Show 31 moreShow less
ubuntu.com/usn/USN-3025-1
slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.431987
rhn.redhat.com/errata/RHSA-2016-2589.html
nvd.nist.gov/vuln/detail/CVE-2016-4994
access.redhat.com/errata/RHSA-2016:2589
bugzilla.redhat.com/show_bug.cgi?id=1348617
github.com/advisories/GHSA-94h5-f27v-4pc3
security-tracker.debian.org/tracker/CVE-2016-4994
advisories.mageia.org/MGASA-2016-0241.html
bugs.mageia.org/show_bug.cgi?id=18804
lwn.net/Alerts/692816
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2589.json
cve.org/CVERecord?id=CVE-2016-4994
suse.com/support/update/announcement/2016/suse-su-20161827-1
bugzilla.suse.com/986021
ubuntu.com/security/CVE-2016-4994