CVE-2025-14424

NameCVE-2025-14424
DescriptionGIMP XCF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XCF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28376.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gimp (PTS)bullseye2.10.22-4+deb11u2fixed
bullseye (security)2.10.22-4+deb11u5fixed
bookworm2.10.34-1+deb12u3fixed
bookworm (security)2.10.34-1+deb12u6fixed
trixie3.0.4-3+deb13u2vulnerable
trixie (security)3.0.4-3+deb13u4fixed
forky, sid3.2.0~RC2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gimpsourcebullseye(not affected)
gimpsourcebookworm(not affected)
gimpsourcetrixie3.0.4-3+deb13u4
gimpsource(unstable)3.2.0~RC2-1

Notes

[bookworm] - gimp <not-affected> (Vulnerable code not present)
[bullseye] - gimp <not-affected> (Vulnerable code not present, poc handled correctly)
https://www.zerodayinitiative.com/advisories/ZDI-25-1138/
https://gitlab.gnome.org/GNOME/gimp/-/issues/15288
Introduced with: https://gitlab.gnome.org/GNOME/gimp/-/commit/a0fc5a025ae3579609730ebabc3c84146385da76 (GIMP_2_99_10)
Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/5cc55d078b7fba995cef77d195fac325ee288ddd (GIMP_3_2_0_RC1)

Search for package or bug name: Reporting problems