CVE-2025-48798
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A flaw was found in GIMP when processing XCF image files. If a user opens a specially crafted file, GIMP can be tricked into making serious memory errors, potentially leading to crashes and use-after-free issues.
Risk Assessment
An attacker could exploit this vulnerability to remotely crash the program or potentially execute code in the user's context, threatening data confidentiality and integrity.
Recommendation
It is recommended to immediately update GIMP to the latest version that includes a fix for this vulnerability. Also avoid opening XCF files from untrusted sources.
Other vulnerabilities in GIMP
See all- CVE-2026-108093Medium
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and crash the GIMP application.
- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-106067Medium
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size.
- CVE-2026-106066Medium
GIMP's raw data export plug-in contains a heap-based buffer overflow. When exporting very large images, sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, leading to a buffer overflow.
- CVE-2026-106065Medium
A heap-based buffer overflow was found in GIMP's PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation.
Original NVD description (English source)
A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS