Every CVE Search/ Get API key

CVE-2022-30067

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the...

5.5 MediumFix available

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.76%Down 0.1 points since May 18, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Record
CVE-2022-30067
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-120
Updated
2026-11-02
CVE List No score

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Record
CVE-2022-30067
Updated
2026-11-02
EUVDEUVD-2022-35281 No score

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Record
EUVD-2022-35281
Updated
2026-11-03
GitHub AdvisoriesGHSA-xhpv-gh4w-v5jf 5.5

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the...

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Record
GHSA-xhpv-gh4w-v5jf
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
OSVRHSA-2022:7978 6.2

Red Hat Security Advisory: gimp security and enhancement update

Record
RHSA-2022:7978
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2022:7978 6.2

Moderate: gimp security and enhancement update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: buffer overflow through a crafted XCF file (CVE-2022-30067)

  • gimp: unhandled exception via a crafted XCF file may lead to DoS (CVE-2022-32990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Record
RLSA-2022:7978
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVUBUNTU-CVE-2022-30067 5.5

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Record
UBUNTU-CVE-2022-30067
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2022:7978 No score

Moderate: gimp security and enhancement update

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

  • gimp: buffer overflow through a crafted XCF file (CVE-2022-30067)
  • gimp: unhandled exception via a crafted XCF file may lead to DoS (CVE-2022-32990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:7978
Updated
2026-11-02
OSV No score

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Record
CVE-2022-30067
Updated
2026-11-02
OSVDEBIAN-CVE-2022-30067 No score

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.

Record
DEBIAN-CVE-2022-30067
Updated
2026-11-03
OSVMGASA-2022-0219 No score

Updated gimp packages fix security vulnerability

GIMP 2.10 is vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash. (CVE-2022-30067)

Record
MGASA-2022-0219
Updated
2026-11-02
OSVopenSUSE-SU-2024:12092-1 No score

gimp-2.10.30-3.1 on GA media

These are all security issues fixed in the gimp-2.10.30-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12092-1
Updated
2026-11-02
OSVSUSE-SU-2022:1889-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2022-30067: Fixed uncontrolled memory consumption via crafted XCF file (bsc#1199653).
Record
SUSE-SU-2022:1889-1
Updated
2026-11-02
OSVSUSE-SU-2022:2063-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2022-30067: Fixed uncontrolled memory consumption via crafted XCF file (bsc#1199653).
Record
SUSE-SU-2022:2063-1
Updated
2026-11-02
OSVSUSE-SU-2022:2619-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE_2022-30067: Fixed an out of memory when reading. (bsc#1199653)
Record
SUSE-SU-2022:2619-1
Updated
2026-11-02
OSVSUSE-SU-2022:2620-1 No score

Security update for gimp

This update for gimp fixes the following issues:

  • CVE-2022-30067: Fixed uncontrolled memory consumption via crafted XCF file (bsc#1199653).
Record
SUSE-SU-2022:2620-1
Updated
2026-11-02
OSVUSN-6521-1 No score

gimp vulnerabilities

It was discovered that GIMP incorrectly handled certain image files. If a user were tricked into opening a specially crafted image, an attacker could use this issue to cause GIMP to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-6521-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-libs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp
Debian:12
 before 2.10.32-1
2.10.32-1
gimp
Debian:13
 before 2.10.32-1
2.10.32-1
gimp
Debian:14
 before 2.10.32-1
2.10.32-1
gimp
Debian:10
From an advisory covering 3 CVEs
 before 2.10.8-2+deb10u1, plus listed versions
2.10.8-2
2.10.8-2+deb10u1
gimp
Debian:11
From an advisory covering 3 CVEs
 before 2.10.22-4+deb11u5, plus listed versions
2.10.22-42.10.22-4+deb11u12.10.22-4+deb11u22.10.22-4+deb11u32.10.22-4+deb11u4
2.10.22-4+deb11u5
gimp
Mageia:8
 before 2.10.24-1.1.mga8
2.10.24-1.1.mga8
gimp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
Show 22 moreShow less
Affected packages
PackageAffectedFixed
gimp-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-devel-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp
Rocky Linux:9
From an advisory covering 2 CVEs
 before 2:2.99.8-3.el9
2:2.99.8-3.el9
gimp
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.8.18-9.21.1
2.8.18-9.21.1
gimp
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 2.8.18-9.21.1
2.8.18-9.21.1
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP3
 before 2.10.12-150300.9.3.1
2.10.12-150300.9.3.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP3
 before 2.10.12-150300.9.3.1
2.10.12-150300.9.3.1
gimp
openSUSE:Leap 15.3
 before 2.10.12-150300.9.3.1
2.10.12-150300.9.3.1
gimp
SUSE:Linux Enterprise Module for Package Hub 15 SP4
 before 2.10.30-150400.3.3.1
2.10.30-150400.3.3.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP4
 before 2.10.30-150400.3.3.1
2.10.30-150400.3.3.1
gimp
openSUSE:Leap 15.4
 before 2.10.30-150400.3.3.1
2.10.30-150400.3.3.1
gimp
SUSE:Linux Enterprise Workstation Extension 15 SP3
 before 2.10.12-150200.3.9.1
2.10.12-150200.3.9.1
gimp
openSUSE:Leap 15.3
 before 2.10.12-150200.3.9.1
2.10.12-150200.3.9.1
gimp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3
 None known
gimp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3
 None known
gimp
Ubuntu:20.04:LTS
 before 2.10.18-1ubuntu0.1, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-32.10.18-1
2.10.18-1ubuntu0.1
gimp
Ubuntu:22.04:LTS
 before 2.10.30-1ubuntu0.1, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build1
2.10.30-1ubuntu0.1
gimp
Ubuntu:20.04:LTS
From an advisory covering 6 CVEs
 before 2.10.18-1ubuntu0.1, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-32.10.18-1
2.10.18-1ubuntu0.1
gimp
Ubuntu:22.04:LTS
From an advisory covering 6 CVEs
 before 2.10.30-1ubuntu0.1, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build1
2.10.30-1ubuntu0.1
gimp
openSUSE:Tumbleweed
 before 2.10.30-3.1
2.10.30-3.1

History

History
RecordedChangedSources
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-30067 is a medium vulnerability (CVSS 5.5) in Gimp, published May 17, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in gimp 2.10.32-1.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open