GIMP CVE-2025-10925

Exploitation requires the victim to open a maliciously crafted ILBM (Interleaved Bitmap / Amiga IFF) image file in GIMP, or visit a page that causes such a file to be opened - the vulnerable code path is GIMP's ILBM file parser, which fails to validate the length of user-supplied data before copying it into a stack buffer. Limiting factors that reduce real-world risk: mandatory user interaction (UI:R - the user must actively open the attacker's file), local attack vector (the file must be delivered to and processed on the target machine), and execution confined to the privileges of the current GIMP user (S:U, no privilege escalation). No authentication is involved (PR:N) because the 'victim' is simply any user running GIMP; ILBM is a niche legacy format, so only users who open such files are reachable.

This is a moderate-priority client-side vulnerability rather than a mass-exploitation emergency. The CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full confidentiality/integrity/availability impact but critically depends on local attack vector plus required user interaction - the victim must be lured into opening a malicious ILBM file or visiting a page that serves one, so there is no network-facing, self-propagating exposure. Note a signal tension: the description repeatedly says 'remote attackers' and 'visit a malicious page,' yet the CVSS vector is AV:L, because ZDI models file-parsing bugs as local (the malicious file must reach and be opened on the target host) - this is consistent ZDI methodology, not an error, but defenders should read 'remote' here as 'attacker-supplied file delivered remotely, triggered locally.' No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit is referenced; the only exploitation signal is that a Trend Micro ZDI researcher privately disclosed it (ZDI-CAN-27793 / ZDI-25-914). Absent EPSS and with no evidence of in-the-wild use, real-world risk is driven by social-engineering feasibility against GIMP users, not by automatable remote attack. A vendor patch is available, which should be the primary mitigation.

An attacker crafts a malicious ILBM (Amiga Interchange File Format) image and distributes it via email attachment, a download link, or a web page, enticing a GIMP user to open it. When GIMP parses the file, unvalidated data length is copied into a stack-based buffer, overflowing it and allowing code execution in the context of the current user. No public proof-of-concept is referenced in the input, so exploitation currently requires the attacker to develop their own exploit.