CVE-2026-112260High· 7.1▾ TwilightA flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
gimp (all versions)gimpgimpgimp:2.8/gimpgimp (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106061Medium· 5.5A flaw was found in GIMP’s X cursor (XMC) thumbnail loader
CVE-2026-96545Medium· 4.4An out-of-bounds heap read flaw was found in GIMP's TIM image loader
CVE-2026-96546Low· 2.5A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader
CVE-2026-78475Medium· 6.1A flaw was found in the file-pix (ESM) plugin in GIMP
CVE-2026-112259Medium· 5.5Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
CVE-2026-112058Medium· 5.5libdvdnav: libdvdnav: Denial of Service via out-of-bounds read in set_PTT (CVE-2026-112058)