{"id":"CVE-2025-2761","aliases":["CLSA-2026-1775144394","CLSA-2026-1775145256","DEBIAN-CVE-2025-2761","DLA-4342-1","DSA-5939-1","EUVD-2025-12174","GHSA-x72f-pwfg-wpx2","MGASA-2026-0012","OESA-2025-1481","OESA-2025-1482","OESA-2025-1483","SUSE-SU-2025:01571-1","SUSE-SU-2025:1546-1","SUSE-SU-2025:1571-1","UBUNTU-CVE-2025-2761"],"status":"published","title":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04172,"percentile":0.90982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-04-23T16:47:31Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel-tools","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-libs","fixed_in":["2:2.99.8-4.el9_6.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel-tools","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-libs","fixed_in":["2:2.99.8-4.el9.2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gimp","fixed_in":["2.10.34-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gimp","fixed_in":["3.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gimp","fixed_in":["3.0.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"gimp","fixed_in":["2.10.6-12.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gimp","fixed_in":["2.10.30-150400.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gimp","fixed_in":["2.10.30-150400.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gimp","fixed_in":["2.8.18-9.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gimp","fixed_in":["2.10.30-150400.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"gimp","fixed_in":["2.10.30-150400.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"gimp","fixed_in":["2.10.30-150400.3.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gimp","fixed_in":["2.8.16-1ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gimp","fixed_in":["2.8.22-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gimp","fixed_in":["2.10.18-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gimp","fixed_in":["2.10.30-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gimp","fixed_in":["2.10.36-3ubuntu0.24.04.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9_6.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-devel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gimp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.34-1+deb12u3"}]}],"versions":["2.10.34-1","2.10.34-1+deb12u1","2.10.34-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.22-4+deb11u3"}]}],"versions":["2.10.22-4","2.10.22-4+deb11u1","2.10.22-4+deb11u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.34-1+deb12u3"}]}],"versions":["2.10.34-1","2.10.34-1+deb12u1","2.10.34-1+deb12u2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.36-1.1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.6-12.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18-9.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-150400.3.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.16-1ubuntu1.1+esm1"}]}],"versions":["2.8.14-1ubuntu2","2.8.14-1.2ubuntu1","2.8.16-1ubuntu1","2.8.16-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.22-1ubuntu0.1~esm1"}]}],"versions":["2.8.20-1","2.8.20-1.1","2.8.20-2","2.8.22-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.18-1ubuntu0.1+esm1"}]}],"versions":["2.10.8-2","2.10.14-2","2.10.14-2build1","2.10.14-2ubuntu1","2.10.14-3","2.10.18-1","2.10.18-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.30-1ubuntu0.1+esm1"}]}],"versions":["2.10.24-2","2.10.28-1","2.10.30-1","2.10.30-1build1","2.10.30-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.36-3ubuntu0.24.04.1+esm1"}]}],"versions":["2.10.34-1","2.10.36-1","2.10.36-2","2.10.36-3build2","2.10.36-3build3","2.10.36-3ubuntu0.24.04.1"]}],"products":[{"vendor":"gimp","product":"gimp"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-204/","tags":["x_research-advisory","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2761","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-204"},{"url":"https://github.com/advisories/GHSA-x72f-pwfg-wpx2"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775144394.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1775145256.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2761.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-2761","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0012.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34363","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DVVZTOVQSBY5ON5P7HYQIXK2OLMSUEH5/","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/11/msg00005.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00103.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00001.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2760","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1482","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1483","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501571-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241691","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2761","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251546-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251571-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-2761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2761","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/13073","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8057-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-2761","title":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","status":"published","published":"2025-04-23T16:47:31.812Z","modified":"2025-11-03T17:32:24.718Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-12174","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","status":"published","published":"2025-04-23T16:47:31Z","modified":"2025-11-03T17:32:24Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:35.000596Z"}],"ghsa":[{"id":"GHSA-x72f-pwfg-wpx2","title":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability...","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","status":"published","published":"2025-04-23T18:30:59Z","modified":"2025-11-03T18:32:20Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:04:17.65818Z"}],"nvd":[{"id":"CVE-2025-2761","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","status":"published","published":"2025-04-23T17:16:54.033Z","modified":"2026-06-17T09:07:34.847Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:11:01.507281Z"}],"osv":[{"id":"CVE-2025-2761","title":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","status":"published","published":"2025-04-23T16:47:31.812Z","modified":"2026-10-28T02:31:09.242811564Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-2761","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","status":"published","published":"2025-04-23T17:16:54.033Z","modified":"2026-09-01T20:05:45.361408954Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1481","title":"gimp security update","description":"The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.\r\n\r\nSecurity Fix(es):\n\nGIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.(CVE-2025-2760)\n\nGIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:50.432040528Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1482","title":"gimp security update","description":"The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.\r\n\r\nSecurity Fix(es):\n\nGIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.(CVE-2025-2760)\n\nGIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:50.542694271Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1483","title":"gimp security update","description":"The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute.\r\n\r\nSecurity Fix(es):\n\nGIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.(CVE-2025-2761)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:50.392848036Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-2761","description":"GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.","status":"published","published":"2025-04-23T17:16:00Z","modified":"2026-04-22T15:41:12.573503Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CLSA-2026-1775144394","title":"gimp: Fix of CVE-2025-2761","description":"- CVE-2025-2761: fix out-of-bounds write in FLI plug-in (ZDI-CAN-25100)","status":"published","published":"2026-04-02T15:39:59Z","modified":"2026-06-01T00:32:46.328145022Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775145256","title":"gimp: Fix of CVE-2025-2761","description":"- CVE-2025-2761: fix out-of-bounds write in FLI plug-in (ZDI-CAN-25100)","status":"published","published":"2026-04-02T15:54:20Z","modified":"2026-06-01T00:32:12.383565677Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"DLA-4342-1","title":"gimp - security update","status":"published","published":"2025-10-22T00:00:00Z","modified":"2025-10-22T19:17:55.728884Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5939-1","title":"gimp - security update","status":"published","published":"2025-06-06T00:00:00Z","modified":"2026-03-09T02:10:33.234302Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0012","title":"Updated gimp packages fix security vulnerabilities","description":"XWD File Parsing Integer Overflow Remote Code Execution Vulnerability.\n(CVE-2025-2760)\nFLI File Parsing Out-Of-Bounds Write Remote Code Execution\nVulnerability. (CVE-2025-2761)\nMultiple heap buffer overflows in tga parser. (CVE-2025-48797)\nMultiple use after free in xcf parser. (CVE-2025-48798)\nXWD File Parsing Heap-based Buffer Overflow Remote Code Execution\nVulnerability. (CVE-2025-10934)\nPNM File Parsing Integer Overflow Remote Code Execution Vulnerability.\n(CVE-2025-14422)\nJP2 File Parsing Heap-based Buffer Overflow Remote Code Execution\nVulnerability. (CVE-2025-14425)\n","status":"published","published":"2026-01-17T02:48:20Z","modified":"2026-04-16T04:44:47.087370254Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"SUSE-SU-2025:01571-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\n- CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write (bsc#1241691).\n","status":"published","published":"2025-06-05T14:08:08Z","modified":"2026-02-04T04:19:26.189912Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:1546-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\n- CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write (bsc#1241691).\n","status":"published","published":"2025-05-13T12:37:05Z","modified":"2026-03-23T04:48:50.050577Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1571-1","title":"Security update for gimp","description":"This update for gimp fixes the following issues:\n\n- CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write (bsc#1241691).\n","status":"published","published":"2025-05-16T13:48:57Z","modified":"2026-02-04T04:07:09.347818Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}