EUVD-2025-18287
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Lifecycle Timeline
4Description
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
Analysis
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
Technical Context
An integer overflow occurs when an arithmetic operation produces a value that exceeds the maximum (or minimum) size of the integer type used to store it. This vulnerability is classified as Integer Overflow or Wraparound (CWE-190).
Affected Products
Affected products: Gimp Gimp 2.8.0
Remediation
Use safe integer arithmetic libraries. Check for overflow conditions before operations. Use appropriately sized integer types.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | released | 2.8.22-1ubuntu0.1~esm3 |
| focal | released | 2.10.18-1ubuntu0.1+esm3 |
| plucky | ignored | end of life, was needs-triage |
| jammy | released | 2.10.30-1ubuntu0.1+esm3 |
| upstream | released | 3.0.4-2 |
| oracular | ignored | end of life, was needs-triage |
| questing | not-affected | 3.0.4-2 |
| noble | released | 2.10.36-3ubuntu0.24.04.1+esm3 |
| xenial | released | 2.8.16-1ubuntu1.1+esm3 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.10.22-4+deb11u3 | - |
| bullseye (security) | fixed | 2.10.22-4+deb11u7 | - |
| bookworm | fixed | 2.10.34-1+deb12u4 | - |
| bookworm (security) | fixed | 2.10.34-1+deb12u9 | - |
| trixie (security), trixie | fixed | 3.0.4-3+deb13u7 | - |
| forky, sid | fixed | 3.2.0~RC3-1 | - |
| (unstable) | fixed | 3.0.4-2 | - |
Share
External POC / Exploit Code
Leaving vuln.today