CVE-2025-10923: GIMP WBMP File Parsing RCE Vulnerability

CVE-2025-10923 Overview

CVE-2025-10923 is an integer overflow vulnerability [CWE-190] in GIMP's WBMP file parser that enables arbitrary code execution. The flaw exists in the routine that allocates a buffer for Wireless Bitmap (WBMP) image data. GIMP fails to validate user-supplied size values, allowing an integer overflow before buffer allocation.

An attacker exploits this issue by tricking a user into opening a crafted WBMP file or visiting a malicious page that delivers one. Successful exploitation executes code in the context of the current GIMP process. The Zero Day Initiative tracked this issue as ZDI-CAN-27878 and published advisory ZDI-25-912.

Critical Impact
Attackers can achieve arbitrary code execution on systems running GIMP 3.0.4 when a user opens a malicious WBMP file, with full confidentiality, integrity, and availability impact.

Affected Products

GIMP 3.0.4
GIMP installations using the affected WBMP file parser
All operating systems where the vulnerable GIMP build runs (Windows, macOS, Linux)

Discovery Timeline

2025-10-29 - CVE-2025-10923 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10923

Vulnerability Analysis

The vulnerability resides in GIMP's WBMP file format handler. WBMP is a monochrome bitmap format originally designed for mobile devices and parsed by GIMP through a dedicated plug-in. When the parser reads image dimensions or length fields from a WBMP file, it performs arithmetic on attacker-controlled values to compute a buffer size.

The arithmetic operation wraps around the maximum representable integer, yielding a small allocation size. The parser then writes a larger volume of file-derived data into this undersized buffer, producing a heap-based memory corruption condition. Attackers shape the overflow to overwrite adjacent heap metadata or function pointers, redirecting execution into attacker-controlled code.

Root Cause

The root cause is missing validation of user-supplied size values before they are used in buffer allocation arithmetic [CWE-190]. The upstream fix is published in commit 2d2d39f3da1d0b01ca7d71ad2b7a8725ee92ed96 in the GNOME GIMP repository, which adds bounds checks to the affected allocation path.

Attack Vector

Exploitation requires user interaction. A target must open a malicious WBMP file in GIMP or visit a page that delivers such a file through a download or file-association handler. The attack vector is local because the attacker-supplied content must be processed by GIMP on the victim's host.

Once execution is achieved, the attacker runs code with the privileges of the user running GIMP. On workstations where designers or analysts run GIMP, this often yields access to user data, credentials cached in the profile, and lateral movement opportunities. See the Zero Day Initiative Advisory ZDI-25-912 for additional technical context.

Detection Methods for CVE-2025-10923

Indicators of Compromise

WBMP files (.wbmp extension) delivered through email, chat, or web downloads from untrusted sources
Unexpected child processes spawned by the gimp or gimp-3.0 binary, particularly shells or scripting interpreters
GIMP process crashes referencing heap corruption or invalid memory access during file open operations
Outbound network connections initiated by the GIMP process shortly after a file open event

Detection Strategies

Monitor endpoint telemetry for GIMP processes spawning command interpreters such as cmd.exe, powershell.exe, /bin/sh, or bash
Inspect file open events where GIMP loads WBMP files originating from browser download directories or email attachment paths
Hunt for memory corruption signatures and crash dumps tied to the GIMP WBMP plug-in across the fleet

Monitoring Recommendations

Track GIMP version inventory and flag any host still running version 3.0.4 or earlier
Alert on creation or execution of WBMP files outside of expected design workflows
Correlate GIMP execution events with subsequent process injection, persistence, or credential access behaviors

How to Mitigate CVE-2025-10923

Immediate Actions Required

Upgrade GIMP to a build that includes commit 2d2d39f3da1d0b01ca7d71ad2b7a8725ee92ed96 or later
Block opening of WBMP files from untrusted sources at the email gateway and web proxy
Educate users who handle untrusted image files to avoid opening attachments from unknown senders in GIMP
Restrict GIMP execution to standard user accounts to limit blast radius of successful exploitation

Patch Information

The upstream fix is available in the GNOME GIMP repository as commit 2d2d39f3da1d0b01ca7d71ad2b7a8725ee92ed96. Apply the patched GIMP build distributed through your operating system package manager or the official GIMP download channels. Verify the installed version after upgrade and remove any older parallel installs that retain the vulnerable plug-in.

Workarounds

Remove or disable the WBMP file format plug-in in GIMP installations that cannot be immediately upgraded
Disassociate the .wbmp extension from GIMP at the operating system level to prevent double-click execution
Apply application allowlisting policies that prevent GIMP from spawning shells or scripting interpreters

bash

# Configuration example: remove the WBMP plug-in on Linux to disable the vulnerable parser
sudo rm /usr/lib/gimp/3.0/plug-ins/file-wbmp/file-wbmp

# Verify installed GIMP version
gimp --version