Critical Security Flaw in GIMP: Remote Code Execution Vulnerabilities
Summary
ALSA-2025:21968: Important: gimp security update. Affects gimp versions < 2:3.0.4-1.el9_7.1. Fixed in 2:3.0.4-1.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image composition and editing tool widely used for tasks such as photo retouching, image editing, and graphic design. It offers a comprehensive toolbox for image manipulation, including support for various file formats, layers, effects, and multi-level undo functionality. However, recent security assessments have revealed multiple vulnerabilities in GIMP that could allow attackers to execute arbitrary code remotely, posing significant risks to users.
Vulnerability Detail
The vulnerabilities identified in GIMP stem from improper handling of various file formats, leading to potential heap-based and stack-based buffer overflows, as well as integer overflows. Specifically, issues have been found in the parsing of DCM, ICNS, WBMP, HDR, ILBM, FF, and XWD files. These vulnerabilities can be exploited by an attacker to craft malicious files that, when opened by GIMP, could lead to remote code execution, allowing unauthorized access to the system and potentially compromising sensitive data.
How To Fix
Minimum fixed version
2:3.0.4-1.el9_7.1
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted files in GIMP until the software is updated. Additionally, consider using alternative image editing tools that do not exhibit these vulnerabilities until a fix is applied.
Conclusion
The recent vulnerabilities discovered in GIMP pose serious security risks that could lead to remote code execution. Users are strongly encouraged to update to the latest patched version to safeguard their systems. Additionally, utilizing tools like Vulert can enhance your ability to monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for gimp →
FAQ
The vulnerabilities involve buffer overflows and integer overflows in the parsing of various file formats, which can lead to remote code execution.
You can verify your version of GIMP by running 'gimp --version' in the terminal. If it is older than 2:3.0.4-1.el9_7.1, it is vulnerable.
Avoid opening any untrusted or suspicious files in GIMP until you can apply the update.
Detailed information can be found on the CVE pages linked in the advisory, specifically CVE-2025-10920 through CVE-2025-10934.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, helping you stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
