PT-2025-32540 · Gimp · Gimp

Karol Mazurek · Published 2025-08-11 · Updated 2025-09-12 · CVE-2025-8672

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GIMP versions prior to 3.1.4.2

Description: The MacOS version of GIMP includes a Python interpreter that inherits Transparency, Consent, and Control (TCC) permissions granted to the main application. An attacker with local access can use this interpreter to execute arbitrary commands or scripts, potentially accessing user files in privacy-protected folders without prompting the user for approval. Accessing resources beyond previously granted TCC permissions may prompt the user for approval under the guise of GIMP, potentially concealing malicious intent.

Recommendations: Update to GIMP version 3.1.4.2 or later.

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-8672

Affected Products

Gimp

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-8672 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8672 · Vendor Advisory
• https://jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware · Note
• https://cert.pl/en/posts/2025/08/tcc-bypass · Note
• https://twitter.com/CVEnew/status/1954897331670974607 · Twitter Post
• https://gitlab.gnome.org/GNOME/gimp/-/issues/13848 · Note
• https://t.me/CVEtracker/29677 · Telegram Post
• https://t.me/cveNotify/135254 · Telegram Post
• https://gitlab.gnome.org/Infrastructure/gimp-macos-build · Note