Every CVE Search/ Get API key

CVE-2025-10921

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

7.8 HighFix available

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.58%Up 0.5 points since Oct 30, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.8

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Record
CVE-2025-10921
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2025-36717 7.8

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Record
EUVD-2025-36717
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6pqm-mccv-6977 7.8

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This...

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Record
GHSA-6pqm-mccv-6977
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
NVD 7.8

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Record
CVE-2025-10921
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSV 7.8

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Record
CVE-2025-10921
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2025-10921 7.8

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Record
DEBIAN-CVE-2025-10921
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVRHSA-2025:21968 7.8

Red Hat Security Advisory: gimp security update

Record
RHSA-2025:21968
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22417 7.8

Red Hat Security Advisory: gimp:2.8 security update

Record
RHSA-2025:22417
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:21968 7.8

Important: gimp security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10922)

  • gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2025-10920)

  • gimp: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10923)

  • gimp: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10921)

  • gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10925)

  • gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10924)

  • gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21968
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:22417 7.8

Important: gimp:2.8 security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10922)

  • gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2025-10920)

  • gimp: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10923)

  • gimp: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10921)

  • gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10925)

  • gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10924)

  • gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:22417
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-10921 7.8

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27803.

Record
UBUNTU-CVE-2025-10921
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2025:21968 No score

Important: gimp security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10922)
  • gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2025-10920)
  • gimp: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10923)
  • gimp: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10921)
  • gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10925)
  • gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10924)
  • gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21968
Updated
2026-11-02
OSVALSA-2025:22417 No score

Important: gimp:2.8 security update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10922)
  • gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2025-10920)
  • gimp: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10923)
  • gimp: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10921)
  • gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10925)
  • gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10924)
  • gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:22417
Updated
2026-11-02
OSVCLSA-2025-1765988423 No score

gegl04: Fix of CVE-2025-10921

  • CVE-2025-10921: fix HDR file parsing heap-based buffer overflow vulnerability
Record
CLSA-2025-1765988423
Updated
2026-11-02
OSVCLSA-2025-1765989021 No score

gegl04: Fix of CVE-2025-10921

  • CVE-2025-10921: fix HDR file parsing heap-based buffer overflow vulnerability
Record
CLSA-2025-1765989021
Updated
2026-11-02
OSVCLSA-2025-1767025227 No score

gimp: Fix of CVE-2025-10921

  • CVE-2025-10921: fix vulnerability by updating gegl04 dependency requirement to gegl04 >= 0.4.34-2.el9.tuxcare.els1
Record
CLSA-2025-1767025227
Updated
2026-11-02
OSVCLSA-2025-1767025812 No score

gimp: Fix of CVE-2025-10921

  • CVE-2025-10921: fix vulnerability by updating gegl04 dependency requirement to gegl04 >= 0.4.34-2.el9.tuxcare.els1
Record
CLSA-2025-1767025812
Updated
2026-11-02
OSVopenSUSE-SU-2025:15793-1 No score

gegl-0.4.64-3.1 on GA media

These are all security issues fixed in the gegl-0.4.64-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15793-1
Updated
2026-11-02
OSVSUSE-SU-2025:4333-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2025-10921: Fixed HDR file parsing heap-based buffer overflow that can lead to remote code execution. (bsc#1250496)
Record
SUSE-SU-2025:4333-1
Updated
2026-11-02
OSVSUSE-SU-2025:4335-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2025-10921: lack of proper validation of user-supplied data when parsing HDR files can lead to RCE (bsc#1250496).
Record
SUSE-SU-2025:4335-1
Updated
2026-11-02
OSVSUSE-SU-2025:4382-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2025-10921: Fixed HDR file parsing heap-based buffer overflow that can lead to remote code execution. (bsc#1250496)
Record
SUSE-SU-2025:4382-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
AlmaLinux:9
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp-libs
AlmaLinux:9
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
2:2.8.22-26.module_el8.10.0+4070+64105a56.3
gimp-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
2:2.8.22-26.module_el8.10.0+4070+64105a56.3
gimp-devel-tools
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
2:2.8.22-26.module_el8.10.0+4070+64105a56.3
gimp-libs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
2:2.8.22-26.module_el8.10.0+4070+64105a56.3
pygobject2
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.28.7-5.module_el8.10.0+3952+571e801c
2.28.7-5.module_el8.10.0+3952+571e801c
pygobject2-codegen
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.28.7-5.module_el8.10.0+3952+571e801c
2.28.7-5.module_el8.10.0+3952+571e801c
pygobject2-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.28.7-5.module_el8.10.0+3952+571e801c
2.28.7-5.module_el8.10.0+3952+571e801c
pygobject2-doc
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.28.7-5.module_el8.10.0+3952+571e801c
2.28.7-5.module_el8.10.0+3952+571e801c
Show 82 moreShow less
Affected packages
PackageAffectedFixed
pygtk2
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-codegen
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
pygtk2-doc
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.24.0-25.module_el8.9.0+3725+d1441900
2.24.0-25.module_el8.9.0+3725+d1441900
python2-cairo
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1.16.3-7.module_el8.10.0+3952+571e801c
1.16.3-7.module_el8.10.0+3952+571e801c
python2-cairo-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1.16.3-7.module_el8.10.0+3952+571e801c
1.16.3-7.module_el8.10.0+3952+571e801c
gegl04
TuxCare:AlmaLinux:9.2
 before 0.4.34-2.el9.tuxcare.els1
0.4.34-2.el9.tuxcare.els1
gegl04-devel
TuxCare:AlmaLinux:9.2
 before 0.4.34-2.el9.tuxcare.els1
0.4.34-2.el9.tuxcare.els1
gegl04-devel-docs
TuxCare:AlmaLinux:9.2
 before 0.4.34-2.el9.tuxcare.els1
0.4.34-2.el9.tuxcare.els1
gegl04-tools
TuxCare:AlmaLinux:9.2
 before 0.4.34-2.el9.tuxcare.els1
0.4.34-2.el9.tuxcare.els1
gegl04
TuxCare:AlmaLinux:9.6
 before 0.4.34-3.el9.tuxcare.els1
0.4.34-3.el9.tuxcare.els1
gegl04-devel
TuxCare:AlmaLinux:9.6
 before 0.4.34-3.el9.tuxcare.els1
0.4.34-3.el9.tuxcare.els1
gegl04-devel-docs
TuxCare:AlmaLinux:9.6
 before 0.4.34-3.el9.tuxcare.els1
0.4.34-3.el9.tuxcare.els1
gegl04-tools
TuxCare:AlmaLinux:9.6
 before 0.4.34-3.el9.tuxcare.els1
0.4.34-3.el9.tuxcare.els1
gimp
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els2
2:2.99.8-4.el9.2.tuxcare.els2
gimp-devel
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els2
2:2.99.8-4.el9.2.tuxcare.els2
gimp-devel-tools
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els2
2:2.99.8-4.el9.2.tuxcare.els2
gimp-libs
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els2
2:2.99.8-4.el9.2.tuxcare.els2
gimp
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els2
2:2.99.8-4.el9_6.2.tuxcare.els2
gimp-devel
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els2
2:2.99.8-4.el9_6.2.tuxcare.els2
gimp-devel-tools
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els2
2:2.99.8-4.el9_6.2.tuxcare.els2
gimp-libs
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els2
2:2.99.8-4.el9_6.2.tuxcare.els2
gegl
Debian:12
 before 1:0.4.42-2+deb12u1, plus listed versions
1:0.4.42-2
1:0.4.42-2+deb12u1
gegl
Debian:13
 before 1:0.4.62-2+deb13u1, plus listed versions
1:0.4.62-2
1:0.4.62-2+deb13u1
gegl
Debian:14
 before 1:0.4.62-3.1, plus listed versions
1:0.4.62-21:0.4.62-2+hurd.11:0.4.62-3
1:0.4.62-3.1
gegl
Debian:11
From an advisory covering 2 CVEs
 before 1:0.4.26-2+deb11u1, plus listed versions
1:0.4.26-2
1:0.4.26-2+deb11u1
gimp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp-devel-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
gimp-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
gimp-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
gimp-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
gimp-devel-tools
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
gimp-devel-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
gimp-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
gimp-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
2:2.8.22-26.module+el8.10.0+23719+f0b80de8.3
pygobject2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-codegen
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygobject2-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.28.7-5.module+el8.10.0+22676+becd68d6
0:2.28.7-5.module+el8.10.0+22676+becd68d6
pygtk2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-codegen
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
pygtk2-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.24.0-25.module+el8.9.0+21228+8e80d31d
0:2.24.0-25.module+el8.9.0+21228+8e80d31d
python2-cairo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-cairo-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-cairo-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-pycairo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
python2-pycairo-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:1.16.3-7.module+el8.10.0+22676+becd68d6
0:1.16.3-7.module+el8.10.0+22676+becd68d6
gimp
Rocky Linux:9
From an advisory covering 7 CVEs
 before 2:3.0.4-1.el9_7.1
2:3.0.4-1.el9_7.1
gimp
Rocky Linux:8
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
2:2.8.22-26.module+el8.10.0+40033+6fd27379.3
gimp
Rocky Linux:8
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
gimp
Rocky Linux:8
From an advisory covering 7 CVEs
 before 2:2.8.22-26.module+el8.10.0+1927+52edb5a0
2:2.8.22-26.module+el8.10.0+1927+52edb5a0
pygobject2
Rocky Linux:8
From an advisory covering 7 CVEs
 before 0:2.28.7-5.module+el8.10.0+1927+52edb5a0
0:2.28.7-5.module+el8.10.0+1927+52edb5a0
pygtk2
Rocky Linux:8
From an advisory covering 7 CVEs
 before 0:2.24.0-25.module+el8.9.0+1723+9bc93544
0:2.24.0-25.module+el8.9.0+1723+9bc93544
python2-pycairo
Rocky Linux:8
From an advisory covering 7 CVEs
 before 0:1.16.3-7.module+el8.10.0+1927+52edb5a0
0:1.16.3-7.module+el8.10.0+1927+52edb5a0
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP6
 before 0.3.34-150000.3.6.1
0.3.34-150000.3.6.1
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP7
 before 0.3.34-150000.3.6.1
0.3.34-150000.3.6.1
gegl
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 0.4.46-150600.4.3.1
0.4.46-150600.4.3.1
gegl
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 0.4.46-150600.4.3.1
0.4.46-150600.4.3.1
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP6
 before 0.4.46-150600.4.3.1
0.4.46-150600.4.3.1
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP7
 before 0.4.46-150600.4.3.1
0.4.46-150600.4.3.1
gegl
openSUSE:Leap 15.6
 before 0.4.46-150600.4.3.1
0.4.46-150600.4.3.1
gegl
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 0.2.0-15.9.1
0.2.0-15.9.1
gegl
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 0.2.0-15.9.1
0.2.0-15.9.1
gegl
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.3.0-4ubuntu20.3.2-1ubuntu10.3.2-1ubuntu20.3.4-1ubuntu10.3.4-1ubuntu20.3.4-1ubuntu2+esm1
 None known
gegl
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.3.20-10.3.20-30.3.24-10.3.28-30.3.30-10.3.30-1ubuntu10.3.30-1ubuntu1+esm1
 None known
gegl
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
0.4.14-10.4.18-1ubuntu10.4.18-20.4.18-2build10.4.22-10.4.22-30.4.22-3ubuntu0.1~esm1
 None known
gegl
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:0.4.32-11:0.4.32-21:0.4.34-11:0.4.34-1build1
 None known
gegl
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:0.4.44-3ubuntu11:0.4.46-41:0.4.48-11:0.4.48-2.4build11:0.4.48-2.4build2
 None known
gegl
Ubuntu:25.10
 All versions, plus listed versions
1:0.4.58-11:0.4.58-21:0.4.62-11:0.4.62-21:0.4.62-31:0.4.62-3.1
 None known
gegl
Ubuntu:26.10
 All versions, plus listed versions
1:0.4.70-11:0.4.70-3build11:0.4.70-4
 None known
gegl
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:0.4.62-3.11:0.4.64-11:0.4.64-21:0.4.66-21:0.4.66-31:0.4.68-11:0.4.70-1
 None known
gegl
openSUSE:Tumbleweed
 before 0.4.64-3.1
0.4.64-3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-10921 is a high vulnerability (CVSS 7.8) in Gimp, published October 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in gegl04 0.4.34-2.el9.tuxcare.els1.

References

Show 67 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open