CVE-2025-10925: GIMP ILBM File Parsing RCE Vulnerability

CVE-2025-10925 Overview

CVE-2025-10925 is a stack-based buffer overflow vulnerability in GIMP, the GNU Image Manipulation Program. The flaw exists in the ILBM (Interleaved Bitmap) file parser, which fails to validate the length of user-supplied data before copying it into a fixed-size stack buffer. Attackers can trigger code execution in the context of the current process by convincing a user to open a malicious ILBM file. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-27793 and published as ZDI-25-914. GIMP version 3.0.4 is confirmed affected.

Critical Impact
Successful exploitation enables arbitrary code execution under the privileges of the user running GIMP, with full impact on confidentiality, integrity, and availability.

Affected Products

GIMP 3.0.4
GIMP installations processing ILBM (Amiga Interleaved Bitmap) files
Cross-platform GIMP deployments on Windows, macOS, and Linux

Discovery Timeline

2025-10-29 - CVE-2025-10925 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10925

Vulnerability Analysis

The vulnerability resides in GIMP's ILBM file format handler. ILBM is a legacy raster image container originally used on Amiga systems and structured around IFF (Interchange File Format) chunks. The parser reads chunk metadata and content from the file and copies portions of that data into a stack-allocated buffer without enforcing a maximum length. An attacker who controls the file controls the size of the copy operation. By supplying a chunk whose declared or actual length exceeds the destination buffer, the attacker overwrites adjacent stack memory, including saved return addresses and frame pointers. The associated weaknesses are stack-based buffer overflow [CWE-121] and out-of-bounds write [CWE-787].

Root Cause

The root cause is missing bounds validation between the size of attacker-controlled ILBM chunk data and the fixed-size stack buffer that receives it. The parser trusts length fields embedded in the malformed file rather than constraining the copy operation to the buffer's capacity. The upstream fix is tracked in GIMP Merge Request 2450.

Attack Vector

Exploitation requires user interaction. The target must open a crafted ILBM file in GIMP or visit a page that triggers GIMP to process such a file. Because GIMP is typically launched by a desktop user, code executes with that user's privileges. The attack vector is local with low complexity and no privileges required, but social engineering — for example, distributing the file via email, chat, or a download link — is the practical delivery method. No public proof-of-concept exploit is currently available.

No verified exploit code is published. Refer to ZDI-25-914 for technical details on the vulnerable parsing path.

Detection Methods for CVE-2025-10925

Indicators of Compromise

ILBM, IFF, LBM, or BBM files received from untrusted sources or staged in user download and temporary directories.
Unexpected child processes spawned by the gimp or gimp-3.0 process, such as shells, scripting interpreters, or network utilities.
GIMP process crashes with stack corruption signatures in system crash logs or core dumps shortly after opening an image file.

Detection Strategies

Monitor endpoint telemetry for GIMP processes invoking unusual binaries (/bin/sh, cmd.exe, powershell.exe, curl, wget) immediately after a file open event.
Hunt for outbound network connections originating from the GIMP process, which is not expected behavior during normal image editing.
Use file-type inspection at email and web gateways to flag IFF/ILBM containers, including renamed extensions, and submit suspicious samples for sandbox detonation.

Monitoring Recommendations

Inventory endpoints running GIMP 3.0.4 and earlier and track them until patched.
Forward GIMP process execution, file access, and crash events to a centralized logging or SIEM platform for correlation.
Alert on repeated GIMP crashes across multiple users, which can indicate exploitation attempts or unstable malicious payloads.

How to Mitigate CVE-2025-10925

Immediate Actions Required

Upgrade GIMP to a version that incorporates the fix from GIMP Merge Request 2450 as soon as it is available from your distribution or the official GIMP project.
Instruct users not to open ILBM, LBM, or IFF files from untrusted email attachments, chat messages, or web downloads.
Restrict GIMP usage on high-value systems and run it under a standard, non-administrative user account.

Patch Information

The upstream fix is tracked in GIMP Merge Request 2450 on the GNOME GitLab instance. Apply the official GIMP release containing this change once published, or rebuild from source with the patch applied. Monitor your Linux distribution's security advisories for backported packages.

Workarounds

Block or quarantine ILBM, LBM, IFF, and BBM file types at email gateways, web proxies, and endpoint file filters until patching is complete.
Associate ILBM file extensions with a benign viewer or remove the GIMP file association so double-clicking does not invoke the vulnerable parser.
Run GIMP inside a sandbox such as Flatpak with restricted filesystem access, Firejail, or a dedicated low-privilege account to limit blast radius if exploited.

bash

# Example: block ILBM file associations and quarantine inbound samples on Linux
xdg-mime default org.gnome.eog.desktop image/x-ilbm
find /home -type f \( -iname '*.ilbm' -o -iname '*.lbm' -o -iname '*.iff' \) \
  -exec mv {} /var/quarantine/ \;