A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is… (CVE-2026-108093)

The vulnerability in GIMP involves the XCF loader processing the image-simulation-intent and image-simulation-bpc parasites without checking if the parasite data is present before dereferencing it. This leads to a NULL pointer dereference and application crash when opening a crafted XCF file with a zero-size simulation parasite. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low complexity, no privileges required, user interaction needed, and impact limited to availability.

Exploitation of this flaw results in a denial-of-service condition by crashing the GIMP application. There is no impact on confidentiality or integrity. The attack requires local access and user interaction to open a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted or suspicious XCF files to prevent application crashes.