CVE-2025-10922
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A heap-based buffer overflow vulnerability in GIMP during DCM file parsing that allows remote code execution. The flaw results from lack of proper validation of user-supplied data length before copying it to a heap-based buffer. User interaction is required — the target must visit a malicious page or open a malicious file.
Risk Assessment
An attacker could execute arbitrary code in the context of the current GIMP process, potentially leading to system compromise if a user opens a malicious DCM file.
Recommendation
Update GIMP to a version containing the fix. Avoid opening DCM files from untrusted sources until updated.
Other vulnerabilities in GIMP
See all- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-119528High
A flaw was found in GIMP's PSD plug-in: the image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
- CVE-2026-92183High
GIMP contains a stack-based buffer overflow in APNG file parsing due to lack of proper validation of user-supplied data length before copying it to a stack buffer. A remote attacker can achieve arbitrary code execution in the context of the current process if the target opens a malicious file or visits a malicious page.
- CVE-2026-112261High
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
- CVE-2026-112258High
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
Original NVD description (English source)
GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27863.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS