Every CVE Search/ Get API key

CVE-2025-2761

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

7.8 HighFix available

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.17%Up 4.1 points since Apr 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.8

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Record
CVE-2025-2761
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2025-12174 7.8

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Record
EUVD-2025-12174
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-x72f-pwfg-wpx2 7.8

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability...

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Record
GHSA-x72f-pwfg-wpx2
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.8

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Record
CVE-2025-2761
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 7.8

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Record
CVE-2025-2761
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2025-2761 7.8

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Record
DEBIAN-CVE-2025-2761
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVOESA-2025-1481 7.8

gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.(CVE-2025-2760)

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)

Record
OESA-2025-1481
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1482 7.8

gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.(CVE-2025-2760)

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)

Record
OESA-2025-1482
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1483 7.8

gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.

Security Fix(es):

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)

Record
OESA-2025-1483
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-2761 7.8

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Record
UBUNTU-CVE-2025-2761
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1775144394 No score

gimp: Fix of CVE-2025-2761

  • CVE-2025-2761: fix out-of-bounds write in FLI plug-in (ZDI-CAN-25100)
Record
CLSA-2026-1775144394
Updated
2026-11-02
OSVCLSA-2026-1775145256 No score

gimp: Fix of CVE-2025-2761

  • CVE-2025-2761: fix out-of-bounds write in FLI plug-in (ZDI-CAN-25100)
Record
CLSA-2026-1775145256
Updated
2026-11-02
OSVMGASA-2026-0012 No score

Updated gimp packages fix security vulnerabilities

XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. (CVE-2025-2760) FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. (CVE-2025-2761) Multiple heap buffer overflows in tga parser. (CVE-2025-48797) Multiple use after free in xcf parser. (CVE-2025-48798) XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-10934) PNM File Parsing Integer Overflow Remote Code Execution Vulnerability. (CVE-2025-14422) JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-14425)

Record
MGASA-2026-0012
Updated
2026-11-02
OSVSUSE-SU-2025:01571-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write (bsc#1241691).
Record
SUSE-SU-2025:01571-1
Updated
2026-11-02
OSVSUSE-SU-2025:1546-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write (bsc#1241691).
Record
SUSE-SU-2025:1546-1
Updated
2026-11-02
OSVSUSE-SU-2025:1571-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write (bsc#1241691).
Record
SUSE-SU-2025:1571-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els6
2:2.99.8-4.el9_6.2.tuxcare.els6
gimp-devel
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els6
2:2.99.8-4.el9_6.2.tuxcare.els6
gimp-devel-tools
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els6
2:2.99.8-4.el9_6.2.tuxcare.els6
gimp-libs
TuxCare:AlmaLinux:9.6
 before 2:2.99.8-4.el9_6.2.tuxcare.els6
2:2.99.8-4.el9_6.2.tuxcare.els6
gimp
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els6
2:2.99.8-4.el9.2.tuxcare.els6
gimp-devel
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els6
2:2.99.8-4.el9.2.tuxcare.els6
gimp-devel-tools
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els6
2:2.99.8-4.el9.2.tuxcare.els6
gimp-libs
TuxCare:AlmaLinux:9.2
 before 2:2.99.8-4.el9.2.tuxcare.els6
2:2.99.8-4.el9.2.tuxcare.els6
gimp
Debian:12
 before 2.10.34-1+deb12u3, plus listed versions
2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u2
2.10.34-1+deb12u3
gimp
Debian:13
 before 3.0.0-1
3.0.0-1
Show 18 moreShow less
Affected packages
PackageAffectedFixed
gimp
Debian:14
 before 3.0.0-1
3.0.0-1
gimp
Debian:11
From an advisory covering 7 CVEs
 before 2.10.22-4+deb11u3, plus listed versions
2.10.22-42.10.22-4+deb11u12.10.22-4+deb11u2
2.10.22-4+deb11u3
gimp
Debian:12
From an advisory covering 4 CVEs
 before 2.10.34-1+deb12u3, plus listed versions
2.10.34-12.10.34-1+deb12u12.10.34-1+deb12u2
2.10.34-1+deb12u3
gimp
Mageia:9
From an advisory covering 7 CVEs
 before 2.10.36-1.1.mga9
2.10.36-1.1.mga9
gimp
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 3.0.2-1.oe2403
3.0.2-1.oe2403
gimp
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 3.0.2-1.oe2403sp1
3.0.2-1.oe2403sp1
gimp
openEuler:20.03-LTS-SP4
 before 2.10.6-12.oe2003sp4
2.10.6-12.oe2003sp4
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 2.10.30-150400.3.14.1
2.10.30-150400.3.14.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP7
 before 2.10.30-150400.3.14.1
2.10.30-150400.3.14.1
gimp
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.8.18-9.30.1
2.8.18-9.30.1
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 2.10.30-150400.3.14.1
2.10.30-150400.3.14.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP6
 before 2.10.30-150400.3.14.1
2.10.30-150400.3.14.1
gimp
openSUSE:Leap 15.6
 before 2.10.30-150400.3.14.1
2.10.30-150400.3.14.1
gimp
Ubuntu:Pro:16.04:LTS
 before 2.8.16-1ubuntu1.1+esm1, plus listed versions
2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.1
2.8.16-1ubuntu1.1+esm1
gimp
Ubuntu:Pro:18.04:LTS
 before 2.8.22-1ubuntu0.1~esm1, plus listed versions
2.8.20-12.8.20-1.12.8.20-22.8.22-1
2.8.22-1ubuntu0.1~esm1
gimp
Ubuntu:Pro:20.04:LTS
 before 2.10.18-1ubuntu0.1+esm1, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-32.10.18-12.10.18-1ubuntu0.1
2.10.18-1ubuntu0.1+esm1
gimp
Ubuntu:Pro:22.04:LTS
 before 2.10.30-1ubuntu0.1+esm1, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.1
2.10.30-1ubuntu0.1+esm1
gimp
Ubuntu:Pro:24.04:LTS
 before 2.10.36-3ubuntu0.24.04.1+esm1, plus listed versions
2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build32.10.36-3ubuntu0.24.04.1
2.10.36-3ubuntu0.24.04.1+esm1

History

History
RecordedChangedSources
affected
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-2761 is a high vulnerability (CVSS 7.8) in Gimp, published April 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.17%, the 90th percentile. Fixed in gimp 2:2.99.8-4.el9_6.2.tuxcare.els6.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open