A flaw was found in the GIMP XCF loader. Marking a channel as linked (PROP_LINKED) stores a raw pointer in linked_channels. A later PROP_SELECTION on the same channel can destroy the object without removing that pointer. At end of load, gimp_item_list_named_new() dereferences the dangling pointer. The CVE-2025-14424 NULL guard does not stop a non-NULL dangling pointer, so this is an incomplete-fix bypass requiring a separate CVE. Reporters demonstrated reclaim of the freed block with attacker-controlled bytes.