CVE-2025-10922

Name	CVE-2025-10922
Description	ZDI-CAN-27863: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4342-1, DSA-6014-1
Debian Bugs	1116459

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gimp (PTS)	bullseye	2.10.22-4+deb11u2	vulnerable
	bullseye (security)	2.10.22-4+deb11u3	fixed
	bookworm (security), bookworm	2.10.34-1+deb12u3	vulnerable
	trixie	3.0.4-3	vulnerable
	trixie (security)	3.0.4-3+deb13u1	fixed
	forky, sid	3.0.4-6.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
gimp	source	bullseye	2.10.22-4+deb11u3	DLA-4342-1
gimp	source	trixie	3.0.4-3+deb13u1	DSA-6014-1
gimp	source	(unstable)	3.0.4-6.1		1116459

Notes

https://www.zerodayinitiative.com/advisories/ZDI-25-911/
https://gitlab.gnome.org/GNOME/gimp/-/issues/14811
https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2444
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/0f309f9a8d82f43fa01383bc5a5c41d28727d9e3