Heap-based buffer overflow in Gimp - CVE-2025-10922

Vulnerability identifier: #VU116094

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-10922

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the load_image() function in plug-ins/common/file-dicom.c when processing DCM files. A remote attacker can trick the victim into opening a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Gimp
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python2-cairo
python2-cairo-devel
gimp (Ubuntu package)
gimp-libs
gimp-devel-tools
gimp-devel
gimp
gimp (Red Hat package)
libgimp-2_0-0
libgimp-2_0-0-debuginfo
libgimpui-2_0-0
gimp-devel-debuginfo
gimp-plugin-aa
libgimpui-2_0-0-debuginfo
gimp-debugsource
gimp-debuginfo
gimp-lang
libgimpui-2_0-0-32bit-debuginfo
libgimpui-2_0-0-32bit
libgimp-2_0-0-32bit
gimp-plugin-aa-debuginfo
libgimp-2_0-0-32bit-debuginfo
libgimp-2_0-0-64bit-debuginfo
libgimp-2_0-0-64bit
libgimpui-2_0-0-64bit-debuginfo
libgimpui-2_0-0-64bit
gimp (Debian package)
pygtk2-codegen
pygtk2-doc
pygtk2
pygtk2-devel
pygobject2-codegen
pygobject2-devel
pygobject2-doc
pygobject2
gimp-extension-goat-excercises
gimp-vala
gimp-plugin-python3

Install updates from vendor's repository.

python2-cairo - update to 1.16.3-7
python2-cairo-devel - update to 1.16.3-7
gimp (Ubuntu package) - addressed in versions 2.8.16-1ubuntu1.1+esm1, 2.8.22-1ubuntu0.1~esm1, 2.10.18-1ubuntu0.1+esm1, 2.10.30-1ubuntu0.1+esm1, 2.10.36-3ubuntu0.24.04.1+esm1
gimp-libs - addressed in versions 2.8.22-1, 2.8.22-26
gimp-devel-tools - addressed in versions 2.8.22-1, 2.8.22-26
gimp-devel - addressed in versions 2.8.22-1, 2.8.22-26
gimp - addressed in versions 2.8.22-1, 2.8.22-26
gimp (Red Hat package) - addressed in versions 2.8.22-1.el7_9.4, 2.99.8-3.el9_0.2, 2.99.8-4.el9_2.2, 2.99.8-4.el9_6.3, 3.0.4-1.el9_7.1
libgimp-2_0-0 - update to 2.10.30-150400.3.32.1
libgimp-2_0-0-debuginfo - update to 2.10.30-150400.3.32.1
libgimpui-2_0-0 - update to 2.10.30-150400.3.32.1
gimp-devel-debuginfo - update to 2.10.30-150400.3.32.1
gimp-devel - update to 2.10.30-150400.3.32.1
gimp-plugin-aa - update to 2.10.30-150400.3.32.1
gimp - update to 2.10.30-150400.3.32.1
libgimpui-2_0-0-debuginfo - update to 2.10.30-150400.3.32.1
gimp-debugsource - update to 2.10.30-150400.3.32.1
gimp-debuginfo - update to 2.10.30-150400.3.32.1
gimp-lang - update to 2.10.30-150400.3.32.1
libgimpui-2_0-0-32bit-debuginfo - update to 2.10.30-150400.3.32.1
libgimpui-2_0-0-32bit - update to 2.10.30-150400.3.32.1
libgimp-2_0-0-32bit - update to 2.10.30-150400.3.32.1
gimp-plugin-aa-debuginfo - update to 2.10.30-150400.3.32.1
libgimp-2_0-0-32bit-debuginfo - update to 2.10.30-150400.3.32.1
libgimp-2_0-0-64bit-debuginfo - update to 2.10.30-150400.3.32.1
libgimp-2_0-0-64bit - update to 2.10.30-150400.3.32.1
libgimpui-2_0-0-64bit-debuginfo - update to 2.10.30-150400.3.32.1
libgimpui-2_0-0-64bit - update to 2.10.30-150400.3.32.1
gimp (Debian package) - addressed in versions 2.10.34-1+deb12u4, 3.0.4-3+deb13u1
pygtk2-codegen - update to 2.24.0-25
pygtk2-doc - update to 2.24.0-25
pygtk2 - update to 2.24.0-25
pygtk2-devel - update to 2.24.0-25
pygobject2-codegen - update to 2.28.7-5
pygobject2-devel - update to 2.28.7-5
pygobject2-doc - update to 2.28.7-5
pygobject2 - update to 2.28.7-5
gimp-extension-goat-excercises - update to 3.0.2-4
gimp - update to 3.0.2-4
gimp-devel - update to 3.0.2-4
gimp-debugsource - update to 3.0.2-4
gimp-debuginfo - update to 3.0.2-4
gimp-vala - update to 3.0.2-4
gimp-plugin-python3 - update to 3.0.2-4
gimp-plugin-aa - update to 3.0.2-4
gimp-libs - update to 3.0.2-4

• https://www.zerodayinitiative.com/advisories/ZDI-25-911/
• https://gitlab.gnome.org/GNOME/gimp/-/commit/3d909166463731e94dfe62042d76225ecfc4c1e4
• https://gitlab.gnome.org/GNOME/gimp/-/issues/14811

• Multiple vulnerabilities in Gimp
• Debian update for gimp
• openEuler 24.03 LTS SP2 update for gimp
• openEuler 24.03 LTS SP1 update for gimp
• openEuler 24.03 LTS update for gimp
• Debian update for gimp
• Red Hat Enterprise Linux 9 update for gimp
• Red Hat Enterprise Linux 8 update for the gimp:2.8 module
• Red Hat Enterprise Linux 9 update for gimp
• Red Hat Enterprise Linux 9 update for gimp
• Red Hat Enterprise Linux 9 update for gimp
• Anolis OS update for gimp:2.8 module
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for gimp
• SUSE update for gimp
• Red Hat Enterprise Linux 8 update for the gimp:2.8 module
• Red Hat Enterprise Linux 8 update for the gimp:2.8 module
• Red Hat Enterprise Linux 8 update for the gimp:2.8 module
• Red Hat Enterprise Linux 8 update for the gimp:2.8 module
• Anolis OS update for gimp
• Ubuntu update for gimp