CVE-2026-112260

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

This vulnerability is rated as an Important severity because it allows arbitrary heap memory exposure and process crashes without requiring privileged access. In Red Hat Enterprise Linux environments, GIMP is an interactive desktop graphics editor rather than a network service, meaning the flaw cannot be triggered remotely without user intervention. An attacker must convince a user to load a specially crafted project file, which may leak confidential process data into generated layers or terminate the application unexpectedly.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package.