CVE-2026-112258: Use After Free in Red Hat Red Hat Enterprise Linux 10

A use-after-free vulnerability exists in the GIMP XCF loader component on Red Hat Enterprise Linux 10. Specifically, when a linked channel is destroyed through a selection property, a dangling pointer remains in the linked-channels list. An attacker can exploit this by crafting a malicious XCF file that triggers the use-after-free condition upon opening, leading to a crash or potentially arbitrary code execution within the main GIMP process.

Successful exploitation can lead to a denial of service via application crash and may allow an attacker to execute arbitrary code with the privileges of the user running GIMP. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

The vendor advisory from Red Hat should be consulted for official remediation guidance. Patch status is not explicitly stated in the provided data; therefore, patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-112258 for current remediation information. Until patched, avoid opening untrusted XCF files to mitigate risk.