CVE-2026-112261High· 7.8▾ TwilightA flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
gimp (all versions)gimpgimpgimp:2.8/gimpgimp (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112258High· 7.8Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
CVE-2026-112257High· 7.8Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
CVE-2026-112259Medium· 5.5Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
CVE-2026-112260High· 7.1Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
CVE-2026-62439High· 7.0Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
CVE-2026-62438Medium· 6.1Gimp: gimp: paa integer overflow out-of-bounds read