{"id":"CVE-2026-112258","kind":"vulnerability","aliases":["CVE-2026-112258"],"related":[],"title":"GIMP: crafted XCF file triggers use-after-free during image load","description":"A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.","summary":"GIMP's XCF loader can leave a dangling pointer in its linked-channels list, which is freed later through a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","gimp","image-editing","package"],"not_affected_if":["no-xcf-files-opened"],"how_to_check":"- Run `gimp --version` to see the installed GIMP version.\n- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T22:17:05+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:10:12+00:00","updated_at":"2026-10-25T03:10:12+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:10:12Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"GIMP: crafted XCF file triggers use-after-free during image load","impact":"high","summary":"GIMP's XCF loader can leave a dangling pointer in its linked-channels list, which is freed later through a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.","category":"package","nicknames":[],"who_cares":["gimp","desktop","image-editing"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker runs code as the user who opens the crafted file.","analyst_note":"Find the affected and fixed GIMP versions and any patch commit at https://nvd.nist.gov/vuln/detail/CVE-2026-112258 or the upstream GIMP advisory.","how_to_check":"- Run `gimp --version` to see the installed GIMP version.\n- unknown","needs_analyst":true,"not_affected_if":["no-xcf-files-opened"],"who_is_affected":"Anyone who opens XCF image files in GIMP, especially files from untrusted sources such as downloads or email attachments. The sources do not list affected version ranges, so unknown. Systems that never open XCF files in GIMP are unlikely to be exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000572,"input_tokens":3292,"output_tokens":486,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112258':15A,18A '-2026':14A,17A 'arbitrari':71B,128C 'caus':54B,111C 'channel':38B,92C,97C 'code':72B,129C 'craft':2A,50B,107C 'crash':68B,125C 'cve':13A,16A 'dangl':32B,86C 'desktop':19B 'destroy':100C 'edit':23B 'execut':73B,130C 'file':4A,52B,109C 'flaw':75C 'found':77C 'free':9A,59B,116C 'freed':42B 'gimp':1A,20B,25B,63B,79C,120C 'imag':11A,22B 'image-edit':21B 'later':43B,99C 'lead':65B,122C 'leav':30B,84C 'link':37B,91C,96C 'linked-channel':36B,90C 'list':39B,93C 'load':12A 'loader':28B,82C 'main':62B,119C 'open':48B,105C 'packag':24B 'pointer':33B,87C 'potenti':70B,127C 'process':64B,121C 'properti':47B,104C 'select':46B,103C 'trigger':5A 'use':7A,57B,114C 'use-after-fre':6A,56B,113C 'via':101C 'xcf':3A,27B,51B,81C,108C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens XCF image files in GIMP, especially files from untrusted sources such as downloads or email attachments. The sources do not list affected version ranges, so unknown. Systems that never open XCF files in GIMP are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112258","severity":null,"published_at":"2026-10-19T22:17:05+00:00","modified_at":"2026-10-21T21:17:55+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}