Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in the GIMP XCF loader. Marking a channel as linked (PROP_LINKED) stores a raw pointer in linked_channels. A later PROP_SELECTION on the same channel can destroy the object without removing that pointer. At end of load, gimp_item_list_named_new() dereferences the dangling pointer. The CVE-2025-14424 NULL guard does not stop a non-NULL dangling pointer, so this is an incomplete-fix bypass requiring a separate CVE. Reporters demonstrated reclaim of the freed block with attacker-controlled bytes.