CVE-2026-112260: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves an out-of-bounds read in GIMP when processing a specially crafted XCF file containing a malformed text-layer parasite. The flaw allows disclosure of adjacent heap memory into the layer text and can lead to denial of service. It affects Red Hat Enterprise Linux 10 installations with GIMP. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can disclose adjacent heap memory contents to the attacker via the layer text, potentially leaking sensitive information. Additionally, it can cause denial of service by crashing the application. There is no indication of integrity compromise or remote exploitation without user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-112260 for current remediation guidance. Until a fix is applied, avoid opening untrusted or suspicious XCF files with GIMP on affected systems.