CVE-2026-112261

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

Red Hat Product Security has rated this issue as having an impact of Important because memory corruption can lead to arbitrary code execution within the context of the user executing the application. GIMP is an interactive desktop image manipulation tool and is not deployed as a network-facing service or background daemon. Consequently, the flaw cannot be exploited without direct user interaction, specifically opening an untrusted, maliciously crafted project file. Earlier versions of Red Hat Enterprise Linux shipping older GIMP major releases are not affected, as the vulnerable code path is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package.