CVE-2026-112258
Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
- Record
CVE-2026-112258- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2026-104652
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
- Record
EUVD-2026-104652- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qq8p-jmjc-fwxx
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list...
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
- Record
GHSA-qq8p-jmjc-fwxx- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-03
NVD
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
- Record
CVE-2026-112258- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-03
OSVDEBIAN-CVE-2026-112258
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
- Record
DEBIAN-CVE-2026-112258- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2026-112258
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
- Record
UBUNTU-CVE-2026-112258- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:12 |
All versions, plus listed versions 2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u102.10.34-1+deb12u22.10.34-1+deb12u3 Show 45 moreShow less2.10.34-1+deb12u42.10.34-1+deb12u52.10.34-1+deb12u62.10.34-1+deb12u72.10.34-1+deb12u82.10.34-1+deb12u92.10.36-12.10.36-22.10.36-32.10.38-12.10.38-22.99.10-12.99.12-12.99.12-22.99.14-12.99.14-22.99.16-12.99.16-22.99.18-13.0.0-13.0.0-23.0.0~RC1-13.0.0~RC1-33.0.0~RC1-43.0.0~RC2-13.0.0~RC3-13.0.2-13.0.2-23.0.2-33.0.2-3.13.0.4-13.0.4-23.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.2 |
None known |
gimpDebian:13 |
All versions, plus listed versions 3.0.4-33.0.4-3+deb13u13.0.4-3+deb13u103.0.4-3+deb13u113.0.4-3+deb13u2 Show 26 moreShow less3.0.4-3+deb13u33.0.4-3+deb13u43.0.4-3+deb13u53.0.4-3+deb13u63.0.4-3+deb13u73.0.4-3+deb13u83.0.4-3+deb13u93.0.4-43.0.4-53.0.4-63.0.4-6.13.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 |
None known |
gimpDebian:14 |
All versions, plus listed versions 3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1 Show 15 moreShow less3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 |
None known |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3 |
None known |
gimpUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3 Show 5 moreShow less2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3 |
None known |
gimpUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3 Show 4 moreShow less2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3 |
None known |
gimpUbuntu:26.10 |
All versions, plus listed versions 3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1 |
None known |
gimpUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3 Show 7 moreShow less3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-112258 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:93975
bugzilla.redhat.com/show_bug.cgi?id=2555588
nvd.nist.gov/vuln/detail/CVE-2026-112258
github.com/advisories/GHSA-qq8p-jmjc-fwxx
security-tracker.debian.org/tracker/CVE-2026-112258
ubuntu.com/security/CVE-2026-112258
cve.org/CVERecord?id=CVE-2026-112258
gitlab.gnome.org/GNOME/gimp/-/work_items/16866
Left out here: 7 versions. The JSON record has them.