PT-2025-51985 · Gimp+3 · Gimp+3

Zdi · Published 2025-12-17 · Updated 2026-03-01 · CVE-2025-14424

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GIMP (affected versions not specified)

Description A flaw exists in the parsing of XCF files within GIMP, leading to a use-after-free condition. This allows remote attackers to potentially execute arbitrary code on affected systems. User interaction is required, specifically the need for a target to open a malicious file or visit a malicious page. The issue stems from a lack of validation to confirm the existence of an object before operations are performed on it, which an attacker can exploit to execute code within the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2026:0914

CVE-2025-14424

DSA-6093-1

OESA-2026-1115

OESA-2026-1116

OESA-2026-1117

OESA-2026-1118

OPENSUSE-RU-2026:20168-1

OPENSUSE-SU-2026:10066-1

OPENSUSE-SU-2026:20100-1

RHSA-2026:0914

ZDI-25-1138

Affected Products

Debian

Gimp

Red Os

Rocky Linux

References · 52

• https://osv.dev/vulnerability/openSUSE-SU-2026:10066-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:0914 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-1138 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20100-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:0914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14423 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1115 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14424 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1118 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-RU-2026:20168-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14424 · Security Note
• https://osv.dev/vulnerability/DSA-6093-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/727277 · Security Note
• https://errata.almalinux.org/9/ALSA-2026-0914.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14424 · Vendor Advisory