Live › vulnerability › CVE-2026-112261
Go to dashboardGIMP mishandles an XCF image that selects a path and then fails to load it, causing a use-after-free in the main process. An attacker who gets a user to open a crafted XCF file can crash GIMP and potentially run arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who opens XCF files from untrusted sources in GIMP on a desktop or workstation is exposed, since the attack needs the user to open the crafted file. Systems that only process images with no interactive GIMP use are less likely exposed. Whether a headless or batch pipeline is exposed is unknown.
No product ranges from the sources yet.
gimp --version to see the installed GIMP version.gimp package version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-112261")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.