CVE-2026-112258

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

• CWE-416

• https://access.redhat.com/security/cve/CVE-2026-112258
• https://bugzilla.redhat.com/show_bug.cgi?id=2555588

Published

Oct 19, 2026

Last Modified

Oct 21, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112249A vulnerability was detected in grandnode grandnode2 up to 2…2.4
• CVE-2026-11225Inappropriate implementation in WebUI in Google Chrome prior…6.5
• CVE-2026-112251A vulnerability was detected in antoinersx clawhost up to 0.…4.3
• CVE-2026-112252A vulnerability has been found in Wuxi Wubang Security Softw…7.3
• CVE-2026-112254A vulnerability was found in agit8or1 clientst0r up to 3.17.…4.3
• CVE-2026-112257A flaw was found in GIMP. The PSD thumbnail resource loader …7.8
• CVE-2026-112259A flaw was found in GIMP. Importing a crafted SBZ palette wi…5.5
• CVE-2026-11226Insufficient policy enforcement in PreviewTab in Google Chro…6.5
• CVE-2026-112260A flaw was found in GIMP. Opening a crafted XCF with a malfo…7.1
• CVE-2026-112261A flaw was found in GIMP. Opening a crafted XCF that selects…7.8
• CVE-2026-112262RisingWave before 3.1.0 contains a missing authorization vul…7.1
• CVE-2026-112263Television (tv) 0.15.0 through 0.15.9 contains an OS command…7.8