CVE-2025-10924: GIMP FF File Parsing RCE Vulnerability

CVE-2025-10924 Overview

CVE-2025-10924 is an integer overflow vulnerability [CWE-190] in GIMP's FF file parser that enables arbitrary code execution. The flaw exists in the routine that parses Farbfeld (FF) image files, where user-supplied dimension values are not properly validated before being used in buffer allocation calculations. An attacker who convinces a user to open a crafted FF file can execute code in the context of the GIMP process. The Zero Day Initiative tracked this issue as ZDI-CAN-27836 and published advisory ZDI-25-913.

Critical Impact
Attackers can achieve arbitrary code execution under the current user's privileges when a victim opens a malicious FF file in GIMP.

Affected Products

GIMP 3.0.4
GIMP installations on Windows, macOS, and Linux that load FF (Farbfeld) image files
Downstream distributions packaging the vulnerable GIMP release

Discovery Timeline

2025-10-29 - CVE-2025-10924 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10924

Vulnerability Analysis

The vulnerability resides in GIMP's FF (Farbfeld) file format parser. Farbfeld is a lossless image format with a simple header that encodes image width and height as 32-bit unsigned integers. GIMP uses these values to compute the size of a heap buffer that stores decoded pixel data.

The parser does not validate the dimensions before multiplying them by the per-pixel size. When the product exceeds the maximum value of the target integer type, the calculation wraps to a small value. GIMP then allocates an undersized buffer and proceeds to read pixel data from the file into it, producing a heap buffer overflow.

An attacker controls both the dimensions in the header and the pixel payload that follows. By selecting values that trigger a controlled wrap and a large attacker-supplied payload, an attacker can corrupt adjacent heap structures and redirect execution to attacker-controlled code.

Root Cause

The root cause is missing arithmetic bounds checking on attacker-supplied dimensions before buffer allocation [CWE-190]. The FF loader trusts the header values from the input file and performs width * height * bytes_per_pixel without verifying the result against integer limits or available memory.

Attack Vector

Exploitation requires user interaction. A victim must open or import a malicious .ff file in GIMP, or visit a page that delivers such a file when GIMP is registered as the handler for the format. Network-based exploitation is not direct; the attack chain typically relies on phishing, watering-hole delivery, or supply-chain distribution of image assets.

For technical specifics, refer to the Zero Day Initiative Advisory ZDI-25-913 and the GNOME GIMP Merge Request containing the fix.

Detection Methods for CVE-2025-10924

Indicators of Compromise

FF format files with header dimensions whose product overflows 32-bit or 64-bit unsigned integer arithmetic
GIMP process crashes referencing heap corruption shortly after opening an image file
Unexpected child processes spawned by gimp or gimp-3.0 (for example, shells, cmd.exe, powershell.exe)
Network connections initiated by the GIMP process to unfamiliar destinations following file open events

Detection Strategies

Inspect inbound .ff files at email and web gateways and parse the header to flag samples with abnormally large width or height fields
Monitor endpoint telemetry for GIMP processes that load image files and subsequently perform process creation, code injection, or persistence operations
Apply YARA or file-format rules that match the Farbfeld magic bytes farbfeld followed by dimensions exceeding sane image sizes

Monitoring Recommendations

Alert on GIMP process crashes recorded in operating system crash logs, particularly access-violation or SIGSEGV events on heap addresses
Track child-process and command-line activity from gimp binaries and correlate with recent file-open events
Audit endpoints for installed GIMP versions and prioritize alerts originating from hosts still running GIMP 3.0.4

How to Mitigate CVE-2025-10924

Immediate Actions Required

Inventory all systems running GIMP 3.0.4 and upgrade to a patched release that incorporates the fix from GIMP Merge Request 2448
Instruct users not to open FF or .ff files received from untrusted sources until patching is complete
Block or quarantine .ff attachments at the email gateway during the remediation window

Patch Information

The GNOME project addressed the issue in GIMP Merge Request 2448, which adds validation of FF header dimensions prior to buffer allocation. Apply the vendor-supplied build for your platform, or install the corresponding package update from your Linux distribution once available. Additional vendor context is available in Zero Day Initiative Advisory ZDI-25-913.

Workarounds

Remove or disable the FF file-format plug-in within the GIMP plug-ins directory if patching cannot be performed immediately
Unassociate the .ff extension from GIMP at the operating system level to prevent double-click execution
Restrict GIMP execution to standard user accounts and enforce application sandboxing such as Flatpak or AppArmor profiles to limit the impact of successful exploitation

bash

# Example: disable the FF loader plug-in on Linux until patched
FF_PLUGIN=$(find ~/.config/GIMP /usr/lib*/gimp -type f -name 'file-ff*' 2>/dev/null)
for f in $FF_PLUGIN; do
  sudo chmod a-x "$f"
done