GIMP CVE-2025-10923

Exploitation requires the victim to open an attacker-crafted WBMP (Wireless Bitmap) image file in GIMP - either by opening the file directly or via a malicious web page that delivers the file - which triggers an integer overflow before buffer allocation in GIMP's WBMP parser. WBMP parsing is default functionality, so no special configuration is needed; the primary limiting factors are the mandatory user interaction (UI:R) and the local attack vector (AV:L), meaning the attacker cannot trigger the flaw remotely without the victim choosing to open the malicious file. Affected version confirmed in input is GIMP 3.0.4; code executes only with the privileges of the user running GIMP.

This is a credible but not emergency-tier priority. The CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly reflects a client-side, file-parsing memory-safety flaw: the attack vector is LOCAL (AV:L) because the victim must open an attacker-supplied WBMP file in GIMP, and exploitation requires user interaction (UI:R), which materially lowers real-world risk versus a remote unauthenticated server flaw. PR:N means no privileges are needed beyond the victim running GIMP, so impact is full code execution in the user's context (C:H/I:H/A:H, scope unchanged). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so per the available signals this is 'no public exploit identified at time of analysis' - exploitation is plausible given CWE-190 integer-overflow-before-allocation but not demonstrated in the wild. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-25-912 / ZDI-CAN-27878), a credible coordinated-disclosure source, and a vendor patch is already available, which further reduces urgency. Net: a genuine high-severity local RCE worth patching on standard cycles, but the UI:R + AV:L constraints and the absence of KEV/POC/EPSS signals mean it is not a drop-everything issue absent evidence of active exploitation.

An attacker crafts a malicious WBMP image that triggers an integer overflow in GIMP's WBMP parser during buffer allocation, then delivers it via email attachment, a download link, or a web page the victim visits. When the target opens the file in GIMP 3.0.4, the undersized buffer is overflowed and attacker-controlled code executes with the privileges of the GIMP process. No public exploit code was identified in the provided data, though the vulnerability was validated by Trend Micro ZDI.