GIMP CVE-2025-14423

Exploitation requires the victim to open or import a maliciously crafted LBM (Interleaved Bitmap/Deluxe Paint) image file in GIMP 3.0.6; the overflow is triggered specifically by the LBM parser's failure to validate user-supplied data length before copying into a fixed-size stack buffer. The decisive limiting factor is mandatory user interaction (UI:R) - there is no network-facing or automatic trigger, so the attacker depends on social engineering to get the target to open the file or visit a page that serves it. Code executes only with the privileges of the local user running GIMP, and no authentication or special privilege is needed by the attacker (PR:N).

This is a genuine, patch-worthy memory-safety flaw but NOT a drop-everything emergency. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) is internally consistent with the description: AV:L reflects that exploitation requires the victim to locally open or load a crafted LBM file rather than a remote network-reachable service, and UI:R captures the mandatory user interaction. The 'remote attackers' framing in the title refers to malicious-file/malicious-page delivery, not unauthenticated network access - this is a client-side file-parsing bug, and the AV:L rating is appropriate; there is no conflict once interpreted correctly. On exploitation signals, the picture is reassuring: no CISA KEV listing, so there is no public exploit identified at time of analysis, and no EPSS score was supplied so widespread opportunistic exploitation probability cannot be quantified from the input. This was a coordinated ZDI disclosure (ZDI-CAN-28311 / ZDI-25-1137) with a vendor patch already available, which lowers urgency relative to actively exploited bugs. The limiting factor is the required social-engineering step (victim must open a malicious LBM/image file), which caps real-world impact to targeted or opportunistic phishing rather than mass exploitation. Net: real priority for environments that process untrusted image files, but a high-CVSS-but-interaction-gated issue rather than a wormable or server-side critical.

An attacker crafts a malicious LBM (Interleaved Bitmap) file whose embedded length field exceeds the destination stack buffer, then delivers it via email, a download link, or a malicious web page. When the GIMP user opens or imports the file, the oversized data overflows the stack buffer and the attacker achieves arbitrary code execution in the context of the GIMP process. No public exploit was identified at time of analysis, but the flaw was found and reported by Trend Micro ZDI.