CVE-2025-15059

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability has been found in GIMP (Image Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. Applying the patch 03575ac8cbb0ef3103b0a15d6598475088dcc15e is able to eliminate this problem.(CVE-2025-15059)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability has been found in GIMP (Image Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. Applying the patch 03575ac8cbb0ef3103b0a15d6598475088dcc15e is able to eliminate this problem.(CVE-2025-15059)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability has been found in GIMP (Image Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. Applying the patch 03575ac8cbb0ef3103b0a15d6598475088dcc15e is able to eliminate this problem.(CVE-2025-15059)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

A vulnerability has been found in GIMP (Image Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. Applying the patch 03575ac8cbb0ef3103b0a15d6598475088dcc15e is able to eliminate this problem.(CVE-2025-15059)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28232.(CVE-2025-15059)

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: heap-based buffer overflow via specially crafted PSP file (CVE-2025-15059)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28232.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

• gimp: heap-based buffer overflow via specially crafted PSP file (CVE-2025-15059)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2025-15059: fix PSP file loader to validate channel types for grayscale images, preventing invalid memory access from incorrect offset computation

• CVE-2025-15059: fix PSP file loader to validate channel types for grayscale images, preventing invalid memory access from incorrect offset computation

This update for gimp fixes the following issues:

Changes in gimp:

• Update to 3.0.8
  • Font Loading Performance
    • Improvements in start-up time for users with a large number of fonts was backported from our 3.2 RC2 release. As a result, we now wait to load images until fonts are initialized - this prevents some occasional odd displays and other issues when an XCF file tried to access a partially loaded font.
  • Assorted updates and fixes
    • Daniel Plakhotich helped us identify an issue when exporting a lossless WEBP image could be affected by lossy settings (such as Quality being less than 100%). We’ve updated our WEBP plug-in to prevent this from happening.
    • Thanks to Jehan‘s efforts, the standard gimp-3.0 executable can now be run with a --no-interface flag instead of requiring users to call gimp-console-3.0 even on devices with no display. The --show-debug-menu flag is now visible as well.
    • programmer_ceds improved our flatpak by adding safe guards to show the correct configuration directory regardless of whether XDG_CONFIG_HOME is defined on the user’s system. This should make it much easier for flatpak users to install and use third party plug-ins.
    • We fixed a rare but possible crash when using the Equalize filter on images with NaN values. Images that contain these are usually created from scientific or mapping data, so you’re unlikely to come across them in standard editing.
    • Jeremy Bicha fixed an internal issue where the wrong version number could be used when installing minor releases (such as the 3.2 release candidates and upcoming 3.2 stable release).
    • As noted in our 3.2RC2 news post, we have updated our SVG import code to improve the rendered path.
    • Further improvements have been made to our non-destructive filter code to improve stability, especially when copying and pasting layers and images with filters attached to them. Some issues related to applying NDE filters on Quick Masks have also been corrected.
    • An unintended Search pop-up that appeared when typing while the Channels dockable was selected has been turned off.
    • When saving XCFs for GIMP 2.10 compatibility, we unintentionally saved Grid color using the new color format. This caused errors when reopening the XCF in 2.10. This problem has now been fixed! If you encounter any other XCF incompatibility, please let us know.
  • Themes and UX
    • The Navigation and Selection Editor dockables no longer show a large bright texture when no image is actively selected. This was especially noticeable on dark themes.
    • When a layer has no active filters, the Fx column had the same “checkbox” outline when hovered over as the lock column. This led to confusion about clicking it to add filters. We have removed the outline on hover as a small step to help address this.
    • Ondřej Míchal fixed alignment and cut-off issues with the buttons on our Transform tool overlays. All buttons should now be properly centered and visible.
    • The options for filling layers with colors when resizing the canvas will be turned off when not relevant (such as when you set layers to not be resized).
    • More GUI elements such as dialog header icons will now respond to your icon size preferences.
    • Ondřej Míchal has continued his work to update our UI with the more usable Spin Scale widget. He has also updated the widget itself to improve how it works for users and developers alike.
  • Security fixes
    • Jacob Boerema and Gabriele Barbero continued to patch potential security issues related to some of our file format plug-ins. In addition to existing fixes mentioned in the release candidate news posts, the following…

These are all security issues fixed in the gimp-3.0.6-4.1 package on the GA media of openSUSE Tumbleweed.

This update for gimp fixes the following issues:

• CVE-2025-15059: Fixed Heap-based Buffer Overflow Remote Code Execution Vulnerability in GIMP PSP File Parsing (bsc#1255766).