PT-2025-23683 · Gimp+9 · Gimp+9

Michael Randrianantenaina · Published 2025-06-03 · Updated 2026-03-10 · CVE-2025-5473

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description This issue allows remote attackers to execute arbitrary code on affected installations. It requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw exists within the parsing of ICO files due to the lack of proper validation of user-supplied data, resulting in an integer overflow before writing to memory. This can be leveraged to execute code in the context of the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2025:9162

ALSA-2025:9165

BDU:2025-11787

CESA-2025_9165

CVE-2025-5473

DLA-4342-1

DSA-5939-1

INFSA-2025_9162

INFSA-2025_9165

OESA-2025-1620

OESA-2025-1621

OESA-2025-1622

RHSA-2025:9162

RHSA-2025:9165

RHSA-2025:9308

RHSA-2025:9309

RHSA-2025:9310

RHSA-2025:9314

RHSA-2025:9315

RHSA-2025:9316

RHSA-2025:9501

RHSA-2025:9569

RHSA-2025_9162

RHSA-2025_9165

SUSE-SU-2025:02100-1

USN-8082-1

ZDI-25-321

Affected Products

Almalinux

Astra Linux

Centos

Debian

Gimp

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 56

• https://ubuntu.com/security/notices/USN-8082-1 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-321 · Security Note
• https://linux.oracle.com/errata/ELSA-2025-9165.html · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-9162.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6035 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5473 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02100-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48797 · Security Note
• https://linux.oracle.com/errata/ELSA-2025-9162.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4342-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1622 · Vendor Advisory
• https://gimp.org/news/2025/05/18/gimp-3-0-4-released/#general-bugfixes · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8082-1 · Vendor Advisory