Live › vulnerability › CVE-2026-112260
Go to dashboardA malformed text-layer parasite in an XCF image file makes GIMP read past a heap buffer. The read can copy neighbouring heap data into the layer text and can crash the program.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who opens untrusted XCF files in GIMP is exposed, most likely on desktop workstations. Systems that never open XCF files from outside sources can skip it. unknown for exact affected GIMP versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-112260")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.