Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in the GIMP XCF loader. PROP_SELECTED_PATH stores a raw pointer in the selected-paths list. If path parsing later fails, the object is destroyed without removing that pointer. End-of-load gimp_image_set_selected_paths() then dereferences the dangling pointer. Reporters demonstrated reclaim with attacker-controlled file bytes.