GIMP CVE-2026-112261

Exploitation requires a user to open a maliciously crafted XCF (GIMP native format) file in which a path/selection is referenced but then fails to load, triggering the use-after-free in the main process - this is the specific condition drawn from the description. Limiting factors: the attack vector is local (AV:L) and demands user interaction (UI:R), so the attacker must first deliver the crafted .xcf file and convince the victim to open it in GIMP; there is no network-facing or automatic trigger. Impact is confined to the context of the user running GIMP (scope unchanged, S:U), so privilege level gained equals that of the victim user, not root, unless combined with a separate privilege-escalation flaw.

This is a genuine high-severity memory-safety flaw but not a drop-everything emergency. The CVSS 3.1 base score of 7.8 is driven by full triad impact (C:H/I:H/A:H) under a local attack vector (AV:L) with low complexity (AC:L) and no privileges (PR:N), but it is gated by required user interaction (UI:R) - the victim must open a malicious XCF file. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The combination of a client-side file-parsing use-after-free with mandatory user interaction and local vector places this firmly in the 'phishing/social-engineering lure' category rather than mass remote exploitation - real risk depends on users being tricked into opening attacker-supplied .xcf files. Note a consistency caveat: PR:N (unauthenticated) is technically correct per CVSS but should not be read as 'remote unauthenticated' - the local vector plus UI:R means an attacker cannot reach the flaw without delivering a file and getting a user to open it. No SSVC decision data, EPSS value, or POC confirmation was supplied, so automatable/exploitation signals cannot be cross-checked; prioritize patching but treat widespread automated exploitation as unlikely absent further evidence.

An attacker crafts a malicious XCF project file that references an internal path/selection which fails to load, triggering a use-after-free when GIMP processes it. The attacker delivers the file via email, a shared design asset, or a download, and a user opens it in GIMP, causing a crash and potentially arbitrary code execution in the user's context. No public exploit code is identified at time of analysis, and the local vector with required user interaction means delivery-plus-victim-action is mandatory.