CVE-2016-4994: Gimp

High severity, CVSS 7.8. EPSS: 3.1% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.

Affected products

• Gimp Gimp: before 2.8.18 (fixed in 2.8.18)

Published 2016-07-12. Last modified 2026-06-17.