Skip to main content

Gimp EUVDEUVD-2025-17358

| CVE-2025-5473 HIGH
Integer Overflow or Wraparound (CWE-190)
2025-06-06 zdi-disclosures@trendmicro.com
RCE Red Hat Gimp Suse
8.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-190
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 8.8 (High) with AV:N/AC:L/PR:N/UI:R indicates significant real-world risk: Network-accessible attack vector means no local access required; Low complexity means no special conditions beyond user interaction; No privileges required for attack initiation; User interaction required mitigates some risk but is easily satisfied through social engineering or drive-by downloads. The integer overflow leading to code execution in the current process context (not sandboxed) has high integrity and confidentiality impact. Real-world priority assessment requires: (1) EPSS exploitation probability—if >0.85, suggests active weaponization likelihood; (2) KEV status—if listed, indicates government awareness of active exploitation; (3) POC availability—ZDI tracking suggests responsible disclosure framework, but POC may be published after patch release. Without EPSS/KEV/POC data, the CVSS alone indicates HIGH priority given the combination of remote accessibility, low attack complexity, and RCE impact. The user interaction requirement is the primary limiting factor but does not substantially reduce risk in targeted attack scenarios.
Exploit ScenarioDerived

An attacker crafts a malicious ICO file with specially constructed header fields designed to trigger integer overflow in GIMP's parser. The attacker distributes this file via email, hosts it on a compromised website, or embeds it in a document. A target user downloads and opens the ICO file in GIMP (AV:N satisfies remote delivery). GIMP's ICO parser processes the file without proper validation of integer fields, causing overflow during memory allocation or offset calculation. The overflow corrupts heap metadata or adjacent memory structures. An attacker can leverage this corruption to achieve code execution within GIMP's process context (running with user privileges). If the user is an administrator or privileged account, compromise severity escalates. Realistic scenario: Attacker sends phishing email with ICO file attachment claiming to be an 'updated application icon pack'—user opens in GIMP to preview, exploitation occurs silently. POC existence depends on ZDI disclosure practices; if POC is public, exploitation difficulty is minimized (AC:L validated).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

Critical remote code execution vulnerability in GIMP's ICO file parser caused by an integer overflow (CWE-190) that lacks proper input validation. This vulnerability affects GIMP users who open malicious ICO files or visit attacker-controlled pages serving malicious images, allowing arbitrary code execution with user privileges. The CVSS score of 8.8 reflects high severity with network-accessible attack vector and required user interaction; exploitation status and active weaponization details require cross-reference with KEV/EPSS data.

RemediationAI

Immediate action: (1) Upgrade GIMP to patched version—consult official GIMP advisory (gimp.org/news) for specific version numbers and availability; (2) Until patching is possible, avoid opening ICO files from untrusted sources and disable ICO format support if feasible through preferences; (3) Monitor GIMP project communications for security updates; (4) For enterprise deployments, restrict GIMP usage to trusted image sources and consider network-level controls blocking ICO file downloads from external sources. Vendor patch availability and version numbers must be obtained from official GIMP security advisories, which would typically be published at gimp.org and coordinated with security mailing lists. No specific patched version provided in description—consult ZDI disclosure timeline and GIMP official sources.

Affected VersionsENISA

GIMP 3.0.2

Affected Packages

euvd gimp no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in GIMP's image file parsing subsystem, specifically the ICO (Windows Icon) format handler. ICO files are structured image containers typically used for application icons but supported by many graphics applications including GIMP. The flaw results from insufficient validation of integer values during ICO header/metadata parsing, leading to an integer overflow condition (CWE-190: Integer Overflow or Wraparound). When processing a maliciously crafted ICO file with specially designed header fields, integer arithmetic overflows occur before memory write operations, corrupting the heap and enabling arbitrary code execution. The vulnerability was discovered and tracked by Zero Day Initiative (ZDI-CAN-26752) before CVE assignment, indicating third-party security research validation.

Know when Gimp gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu MEDIUM
SUSE 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat 7.8 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jun 06, 2025 - 19:15 nvd
HIGH 8.8

DescriptionCVE.org

GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26752.

Executive ViewAI

Why It Matters

GIMP users face a high-severity remote code execution risk when opening malicious ICO image files, potentially allowing attackers to gain full system access under the user's privileges. This vulnerability poses significant risk to organizations where GIMP is used for graphics processing, particularly in design, marketing, and content creation departments, as well as any users who may receive untrusted image files.

Business Impact: High
Compensating Controls

Disable ICO file type handling in GIMP preferences; implement file type filtering at email gateways to block ICO attachments from external senders; restrict GIMP execution through application whitelisting; isolate GIMP installations on segmented networks with limited outbound access; consider disabling GIMP on systems where not operationally required; monitor for suspicious process execution from GIMP processes.

Threat Intelligence Overview

EPSS Score
0.6%
Top 30% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Gimp

View all
CVE-2012-2763 HIGH POC
7.5 Jul 12

Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and p
CVE-2012-5576 HIGH POC
7.5 Dec 18

Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attack
CVE-2017-17789 HIGH POC
7.8 Dec 20

In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Rated high sev
CVE-2012-3236 MEDIUM POC
4.3 Jul 12

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
CVE-2022-32990 MEDIUM POC
5.5 Jun 24

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via

CVE-2022-30067 MEDIUM POC
5.5 May 17

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Rated medium severity (CVSS 5.5), this vulnerability is no a
CVE-2018-12713 CRITICAL
9.1 Jun 24

GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that alre
CVE-2026-2044 HIGH
8.8 Feb 20

Remote code execution in GIMP 3.0.6 allows attackers to run arbitrary code by tricking a user into opening a malicious P
CVE-2026-0797 HIGH
8.8 Feb 20

Remote code execution in GIMP 3.2.0-rc1 lets attackers run arbitrary code by tricking a user into opening a malicious IC
CVE-2016-4994 HIGH
7.8 Jul 12

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cau
CVE-2026-18307 HIGH
7.8 Aug 20

Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF imag
CVE-2026-2050 HIGH
7.8 Jun 24

Arbitrary code execution in GIMP results from a heap-based buffer overflow in the HDR file parser, where attacker-contro

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

Ubuntu

Priority: Medium
gimp
Release Status Version
upstream released 3.0.2-3.1
bionic released 2.8.22-1ubuntu0.1~esm3
focal released 2.10.18-1ubuntu0.1+esm3
jammy released 2.10.30-1ubuntu0.1+esm3
noble released 2.10.36-3ubuntu0.24.04.1+esm3
oracular ignored end of life, was needs-triage
questing not-affected 3.0.4-3
plucky ignored end of life, was needs-triage
xenial released 2.8.16-1ubuntu1.1+esm3
USN-8082-1

Debian

Bug #1105005
gimp
Release Status Fixed Version Urgency
bullseye fixed 2.10.22-4+deb11u3 -
bullseye (security) fixed 2.10.22-4+deb11u6 -
bookworm fixed 2.10.34-1+deb12u3 -
bookworm (security) fixed 2.10.34-1+deb12u9 -
trixie (security), trixie fixed 3.0.4-3+deb13u7 -
forky, sid fixed 3.2.0~RC3-1 -
(unstable) fixed 3.0.2-3.1 -
DLA-4342-1 DSA-5939-1

SUSE

Severity: High
Product Status
SUSE Liberty Linux 7 LTSS Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:9162 ADVISORY https://access.redhat.com/errata/RHSA-2025:9165 ADVISORY https://access.redhat.com/errata/RHSA-2025:9308 ADVISORY https://access.redhat.com/errata/RHSA-2025:9309 ADVISORY https://access.redhat.com/errata/RHSA-2025:9310 ADVISORY https://access.redhat.com/errata/RHSA-2025:9314 ADVISORY https://access.redhat.com/errata/RHSA-2025:9315 ADVISORY https://access.redhat.com/errata/RHSA-2025:9316 ADVISORY https://access.redhat.com/errata/RHSA-2025:9501 ADVISORY https://access.redhat.com/errata/RHSA-2025:9569 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-5473 ADVISORY https://security-tracker.debian.org/tracker/dla-4342-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-5939-1 ADVISORY https://ubuntu.com/security/notices/USN-8082-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02100/ REF https://lists.debian.org/debian-lts-announce/2025/10/msg00022.html REF https://www.gimp.org/news/2025/05/18/gimp-3-0-4-released/#general-bugfixes REF https://www.zerodayinitiative.com/advisories/ZDI-25-321/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy