A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap… (CVE-2026-112260)

CVE-2026-112260 describes a vulnerability in GIMP where processing a specially crafted XCF file with a malformed text-layer parasite triggers a heap out-of-bounds read. This results in disclosure of adjacent heap data into the layer text and causes denial of service. The vulnerability is classified under CWE-125 (Out-of-bounds Read). The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can lead to disclosure of adjacent heap memory contents, potentially leaking sensitive information, and cause denial of service by crashing the application. There is no indication of integrity compromise. The attack requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted or suspicious XCF files containing text layers in GIMP.