CVE-2026-112261
Description
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
Statement
Red Hat Product Security has rated this issue as having an impact of Important because memory corruption can lead to arbitrary code execution within the context of the user executing the application. GIMP is an interactive desktop image manipulation tool and is not deployed as a network-facing service or background daemon. Consequently, the flaw cannot be exploited without direct user interaction, specifically opening an untrusted, maliciously crafted project file. Earlier versions of Red Hat Enterprise Linux shipping older GIMP major releases are not affected, as the vulnerable code path is not present.
Mitigation
Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Acknowledgements
Red Hat would like to thank Alexey Khairov (codem4ster, dedicated to Diana), Konstantin Talgarenko (Marcusov, dedicated to Karina), and Nikolay Kravtsov (Kolya080808, dedicated to Nonna) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
