GIMP’s XCF loader contains a use‑after‑free bug caused by a dangling pointer in the linked‑channels list. When a linked channel is destroyed via a selection property, the loader may later access freed memory. Opening a specially crafted XCF file can trigger a crash, and because the process may execute code from the freed area, the flaw can lead to arbitrary code execution. The weakness is a classic use‑after‑free, classified as CWE‑416.

The vulnerability is present in the GIMP package distributed with Red Hat Enterprise Linux 10 through 9. These distributions include the vulnerable GIMP binary, and any installation that uses the default XCF loader without a patch is susceptible. No specific product versions are listed, so any release of GIMP shipped with these OS families is at risk.

The CVSS base score of 7.8 reflects a non‑trivial impact. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploitation yet. An attacker would need to supply a crafted XCF file and get the victim to open it. The attack vector is likely local or remote via file download, and the exploitation would produce a crash and potentially allow the attacker to run arbitrary code within the context of the GIMP process. The recommended workaround is to avoid opening untrusted XCF files until a vendor update is released.