GIMP
CVE-2025-10924
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious FF file to victim
-
DeliveryUser opens file in GIMP
-
ExploitTrigger integer overflow in FF parser
-
ExecutionUndersized buffer allocation and memory corruption
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied file in the FF file format using GIMP (or visit a page that triggers GIMP to process such a file); it is not triggerable without this user action. The CVSS vector is AV:L/UI:R, so the limiting factors are local delivery and mandatory user interaction - there is no network-facing or unattended trigger. PR:N means no prior authentication to GIMP is needed, but the attacker must still get the malicious FF file onto the target and convince the user to open it. Affected configuration per NVD is GIMP 3.0.4; applying the vendor fix (GNOME GitLab MR 2448) removes the condition. |
| Impact | This is a genuine code-execution flaw but not a drop-everything priority. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local attack vector requiring user interaction - consistent with the description, which states the victim must open a malicious FF file or visit a malicious page. This is not remotely triggerable without a user action, which materially lowers real-world urgency versus a true network RCE. No EPSS score was supplied in the input, and the CVE is NOT listed in CISA KEV; no public POC is referenced beyond the ZDI advisory, so there is no public exploit identified at time of analysis. The signals are internally consistent (ZDI-sourced client-side RCE, integer overflow per CWE-190), so there is no contradiction to flag - but the absence of EPSS, KEV, and public exploit code means exploitation likelihood is unquantified and currently appears low/targeted rather than widespread. Net: a credible, patch-worthy client-side RCE in a popular application, best treated as important-to-patch rather than emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious FF-format file and delivers it via email, a download link, or a web page, relying on social engineering to get the victim to open it in GIMP. When GIMP parses the file, an integer overflow occurs before buffer allocation, producing an undersized buffer and memory corruption that the attacker leverages to execute arbitrary code in the context of the GIMP process. No public exploit code is referenced beyond the private ZDI advisory (ZDI-25-913 / ZDI-CAN-27836). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Integer overflow in GIMP 3.0.4's FF file parser allows attackers to execute arbitrary code in the context of the current process when a user opens a crafted FF file or visits a page triggering GIMP to process one. The vulnerability requires mandatory user interaction and local delivery (CVSS 3.1 AV:L/UI:R, PR:N), so it is not network-facing or unattended; exploitation hinges on convincing the victim to open an attacker-supplied file. Publicly available exploit code exists via the ZDI advisory, though no confirmed active exploitation (CISA KEV) is reported; a vendor fix is available through GNOME GitLab merge request 2448.
RemediationAI
Apply the vendor-released fix referenced by GNOME GitLab merge request 2448 (https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2448); consult the vendor advisory and release notes to confirm the exact patched GIMP version for your distribution before upgrading from 3.0.4 - no specific patched version number is confirmed in the provided data. As a compensating control pending upgrade, avoid opening untrusted or unexpected FF (.ff) files in GIMP and remove or restrict FF format handling where feasible; note that disabling a format plugin may break legitimate workflows requiring that format. Because exploitation requires user interaction, enforce user awareness and email/web download controls that prevent automatic opening of image files in GIMP, with the trade-off of added friction for normal image-review tasks. Do not rely on network perimeter controls, as the CVSS vector is local with user interaction.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-190 integer overflow in GIMP's parsing of FF (Farbfeld) image files. GIMP fails to properly validate user-supplied size/length values during FF parsing, allowing arithmetic used to compute a buffer size to wrap around; the undersized allocation is then populated with attacker-controlled data, producing a heap-based out-of-bounds write that can be redirected into arbitrary code execution in the current process. The affected artifact identified by CPE is gimp:gimp:3.0.4. Because GIMP is a desktop image editor, the attack surface is local file parsing, consistent with the CVSS AV:L/UI:R vector - the attacker must deliver a malicious FF file and induce the user to open it (or cause GIMP to process such a file). ZDI tracked the issue as ZDI-CAN-27836 and published it as ZDI-25-913.
Know when Gimp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R because the victim must locally open a malicious file; PR:N as no GIMP authentication is required; C/I/A:H since code executes in the user's process context.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of FF files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27836.
Executive ViewAI
GIMP 3.0.4 contains a high-severity integer overflow in its FF file parser that can let a crafted file execute arbitrary code in the context of the user who opens it. The issue requires local delivery and user interaction, so risk is concentrated on workstation users who handle untrusted FF files; publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. Leadership should care because a successful attack could compromise user endpoints and data under the user's privileges, and remediation requires coordinated patching and user awareness.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lack
Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag
GitHub PoC
Exploit-DB