CVE-2026-112259

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires user interaction and is limited to a local denial of service. An attacker must convince a user to import a specially crafted SwatchBooker palette file into the graphical application. Because palette parsing occurs directly in the primary application process rather than an isolated plugin sandbox, encountering the malformed file triggers an abnormal termination of GIMP. The flaw cannot be leveraged for remote code execution or unauthorized access to system resources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid importing untrusted SBZ palette files. If GIMP is unused, remove the gimp package.