GIMP CVE-2025-14424

Exploitation requires the victim to open or load an attacker-supplied malicious XCF file in GIMP (CVSS UI:R and AV:L confirm user interaction and local file handling are mandatory), so there is no unauthenticated remote-network exploitation path against a listening service. The specific trigger is GIMP's XCF file parser operating on an object whose existence is not validated, producing a use-after-free (CWE-416). Limiting factors: the attacker must socially engineer the user into opening the file, the affected configuration is the GIMP 3.0.6 XCF parser, and code executes only in the current user's context (S:U, no privilege escalation or sandbox escape implied); no network service exposure exists.

This is a classic client-side memory-corruption flaw with a severity-vs-urgency gap worth highlighting. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) correctly models it as a LOCAL attack vector requiring user interaction - exploitation only occurs when a victim opens or is lured into loading a malicious XCF file, not via any network-listening service, so despite the description's 'remote attackers' framing the actual delivery is file/social-engineering based (the description's reference to 'visit a malicious page' means a downloaded/opened file, not a direct network service - the AV:L designation is the authoritative signal here). On the urgency side there is no CISA KEV listing and no EPSS score or POC was provided in the input, so there is no evidence of active or imminent mass exploitation; this reads as a real-but-not-emergency issue. Mitigating the urgency further: a vendor patch already exists (GNOME GitLab commit 5cc55d078b7fba995cef77d195fac325ee288ddd), and successful exploitation of a use-after-free (CWE-416) in a desktop image editor still demands crafting a reliable heap-grooming exploit and convincing a user to open the file. No SSVC decision data was supplied, so automatable/technical-impact framework scoring cannot be stated. Net: credible RCE in a popular application that should be patched on a normal-to-expedited cycle, but not a drop-everything emergency absent KEV/EPSS/POC signals.

An attacker crafts a malformed GIMP XCF project file that triggers the use-after-free during parsing and emails it or hosts it on a download page disguised as legitimate artwork or a template. A victim opens the file in GIMP 3.0.6, the freed object is operated on during parsing, and the attacker's heap-controlled data leads to arbitrary code execution in the context of the GIMP process. No public proof-of-concept was identified in the provided data, so a working exploit would need to be developed.