CVE-2025-2760

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.(CVE-2025-2760)

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.(CVE-2025-2760)

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)

GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.

XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. (CVE-2025-2760) FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. (CVE-2025-2761) Multiple heap buffer overflows in tga parser. (CVE-2025-48797) Multiple use after free in xcf parser. (CVE-2025-48798) XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-10934) PNM File Parsing Integer Overflow Remote Code Execution Vulnerability. (CVE-2025-14422) JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-14425)

These are all security issues fixed in the gimp-3.0.4-2.1 package on the GA media of openSUSE Tumbleweed.

This update for gimp fixes the following issues:

Changes in gimp:

Update to 3.0.6:

• Security:

  • During development, we received reports from the Zero Day Initiative of potential security issues with some of our file import plug-ins. While these issues are very unlikely to occur with real files, developers like Jacob Boerema and Alx Sa proactively improved security for those imports. The resolved reports are:
    • ZDI-CAN-27793
    • ZDI-CAN-27823
    • ZDI-CAN-27836
    • ZDI-CAN-27878
    • ZDI-CAN-27863
    • ZDI-CAN-27684

• Core:

  • Many false-positive build warnings have been cleaned out (and proper issues fixed).

  • Various crashes fixed.

  • When creating a layer mask from the layer's alpha, but the layer has no alpha, simply fill the mask with complete opacity instead of a completely transparent layer.

  • Various core infrastructure code reviewed, cleaned up, refactored and improved, in drawable, layer and filter handling code, tree view code, and more.

  • GIMP_ICONS_LIKE_A_BOSS environment variable is not working anymore (because "gtk-menu-images" and "gtk-button-images" have been deprecated in GTK3 and removed in GTK4) and was therefore removed.

  • Lock Content now shows as an undo step.

  • Add alpha channel for certain transforms.

  • Add alpha channel on filter merge, when necessary.

  • Filters can now be applied non-destructively on channels.

  • Improved Photoshop brush support.

  • After deleting a palette entry, the next entry is automatically selected. This allows easily deleting several entries in a row, among other usage.

  • Resize image to layers irrespective to selections.

  • Improved in-GUI release notes' demo script language:

    • We can now set a button value to click it: "toolbox:text, tool-options:outline=1, tool-options:outline-direction"
    • Color selector's module names can be used as identifiers: "color-editor,color-editor:CMYK=1,color-editor:total-ink-coverage"

  • Fixed Alpha to Selection on single layers with no transparency.

  • Various code is slowly ported to newer code, preparing for GTK4 port (in an unplanned future step):

    • Using g_set_str() (optionally redefining it in our core code to avoid bumping the GLib minimum requirement).
    • Start using GListModel in various pieces of code, in particular getting rid of more and more usage of GtkTreeView when possible (as it will be deprecated with GTK4).
    • New GimpRow class for all future row widgets.
    • Use more of G_DECLARE_DERIVABLE_TYPE and G_DECLARE_FINAL_TYPE where relevant.
    • New GimpContainerListView using a GtkListBox.
    • New GimpRowSeparator, GimpRowSettings, GimpRowFilter and GimpRowDrawableFilter widgets.

  • (Experimental) GEX Format was updated.

  • Palette import:

    • Set alpha value for image palette imports.
    • Fix Lab & CMYK ACB palette import.
    • Add palette format filters to import dialog, making it more apparent what palette formats are supported, and giving the ability to hide irrelevant files.

  • Improved filter actions' sensitivity to make sure they are set insensitive when relevant. In particular filters which cannot be run non-destructively (e.g. filters with aux inputs, non-interactive filters and GEGL Graph) must be insensitive when trying to run them on group layers.

  • Fix bad axis centering on zoom out.

  • Export better SVG when exporting paths.

• Tools:

  • Text tool: make sure the default color is only changed when the user confirms the color change.
  • Foreground Selection tool: do not create a selection when no strokes has been made. In particular this removes the unnecessary delay which happened when switching to another tool without…

This update for gimp fixes the following issues:

• CVE-2025-2760: lack of proper validation of user-supplied data in DDS parser can lead to integer overflow and remote code execution (bsc#1241690).