Critical Security Flaw in GIMP: Heap-Based Buffer Overflow Vulnerability
Summary
ALSA-2026:2707: Important: gimp security update. Affects gimp versions < 2:3.0.4-1.el9_7.3. Fixed in 2:3.0.4-1.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GIMP (GNU Image Manipulation Program) is a powerful open-source image composition and editing tool widely used for tasks such as photo retouching, image editing, and graphic design. It features a comprehensive toolbox that includes layers, effects, and multi-level undo capabilities. However, a recent vulnerability has been identified that could potentially compromise the security of users' systems when handling specific file types.
Vulnerability Detail
The vulnerability, identified as CVE-2025-15059, is a heap-based buffer overflow that occurs when GIMP processes specially crafted PSP files. This flaw can lead to arbitrary code execution, allowing attackers to manipulate the application and potentially gain unauthorized access to the system. The risk is particularly significant as it can be exploited through malicious files, making it crucial for users to update their software promptly.
How To Fix
Minimum fixed version
2:3.0.4-1.el9_7.3
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening PSP files from untrusted sources until the software is updated. Additionally, consider using alternative image formats that do not trigger this vulnerability.
Conclusion
The heap-based buffer overflow vulnerability in GIMP poses a significant security risk, particularly when handling PSP files. Users are strongly encouraged to update their software to the latest patched version to mitigate this risk. By staying informed and proactive, users can protect their systems from potential exploits.
See every vulnerability recorded for gimp →
FAQ
The vulnerability is a heap-based buffer overflow that can be exploited through specially crafted PSP files.
If you are using a version prior to 2:3.0.4-1.el9_7.3, your installation is vulnerable.
Avoid opening PSP files from untrusted sources and consider using alternative image formats.
Detailed information can be found on the CVE page for CVE-2025-15059.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json, without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
