{"id":"CVE-2026-112261","kind":"vulnerability","aliases":["CVE-2026-112261"],"related":[],"title":"GIMP: crafted XCF file triggers use-after-free and possible code execution","description":"A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.","summary":"GIMP mishandles an XCF image that selects a path and then fails to load it, causing a use-after-free in the main process. An attacker who gets a user to open a crafted XCF file can crash GIMP and potentially run arbitrary code.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","gimp","package","workstation"],"not_affected_if":["no-untrusted-xcf"],"how_to_check":"- Run `gimp --version` to see the installed GIMP version.\n- Check the package manager for the installed `gimp` package version.","fix":"- Upgrade GIMP to a fixed release; the fixed version is unknown from the sources.\n- Do not open untrusted XCF files until patched.","status":"open","published_at":"2026-10-19T22:17:05+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:10:10+00:00","updated_at":"2026-10-25T03:10:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:10:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GIMP to a fixed release; the fixed version is unknown from the sources.\n- Do not open untrusted XCF files until patched.","reach":"local","title":"GIMP: crafted XCF file triggers use-after-free and possible code execution","impact":"high","summary":"GIMP mishandles an XCF image that selects a path and then fails to load it, causing a use-after-free in the main process. An attacker who gets a user to open a crafted XCF file can crash GIMP and potentially run arbitrary code.","category":"package","nicknames":[],"who_cares":["gimp","desktop","workstation"],"confidence":0.6,"needs_auth":"no","worst_case":"Code runs as the user who opened the file.","analyst_note":"Confirm the fixed GIMP version and the affected version range from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112261 and the upstream GIMP advisory.","how_to_check":"- Run `gimp --version` to see the installed GIMP version.\n- Check the package manager for the installed `gimp` package version.","needs_analyst":true,"not_affected_if":["no-untrusted-xcf"],"who_is_affected":"Anyone who opens XCF files from untrusted sources in GIMP on a desktop or workstation is exposed, since the attack needs the user to open the crafted file. Systems that only process images with no interactive GIMP use are less likely exposed. Whether a headless or batch pipeline is exposed is unknown.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000603,"input_tokens":3258,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112261':16A,19A '-2026':15A,18A 'arbitrari':67B,107C 'attack':50B 'caus':39B,91C 'code':12A,68B,108C 'craft':2A,58B,77C 'crash':62B,104C 'cve':14A,17A 'desktop':20B 'execut':13A,109C 'fail':35B,85C 'file':4A,60B 'flaw':70C 'found':72C 'free':9A,44B,96C 'get':52B 'gimp':1A,21B,24B,63B,74C 'imag':28B 'lead':101C 'load':37B,87C 'main':47B,99C 'mishandl':25B 'open':56B,75C 'packag':22B 'path':32B,82C,89C 'possibl':11A 'potenti':65B,106C 'process':48B,100C 'run':66B 'select':30B,80C 'trigger':5A 'use':7A,42B,94C 'use-after-fre':6A,41B,93C 'user':54B 'workstat':23B 'xcf':3A,27B,59B,78C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens XCF files from untrusted sources in GIMP on a desktop or workstation is exposed, since the attack needs the user to open the crafted file. Systems that only process images with no interactive GIMP use are less likely exposed. Whether a headless or batch pipeline is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112261","severity":null,"published_at":"2026-10-19T22:17:05+00:00","modified_at":"2026-10-20T17:17:30+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}