CVE-2025-15059: GIMP PSP File Parsing RCE Vulnerability

CVE-2025-15059 Overview

CVE-2025-15059 is a heap-based buffer overflow vulnerability in GIMP's PSP (Paint Shop Pro) file parsing functionality. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability—the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Critical Impact

Successful exploitation enables remote code execution with the privileges of the current user. Attackers can achieve full system compromise if users open maliciously crafted PSP files.

Affected Products

• GIMP (GNU Image Manipulation Program)
• Systems with GIMP installations capable of parsing PSP file formats
• Any application or plugin utilizing GIMP's PSP file parsing libraries

Discovery Timeline

• 2026-01-23 - CVE-2025-15059 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-15059

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The flaw resides in GIMP's PSP file parsing component, where insufficient validation of user-supplied data length allows attackers to overflow a heap-based buffer. When a user opens a specially crafted PSP file, the parser fails to properly validate the size of certain data fields before copying them into memory buffers allocated on the heap.

The attack requires local access (typically through a malicious file) and user interaction to trigger. Once exploited, an attacker gains the ability to execute arbitrary code with the same privileges as the GIMP process, potentially leading to complete system compromise, data theft, or further lateral movement within the network.

Root Cause

The root cause of CVE-2025-15059 is improper input validation in the PSP file parsing routines. Specifically, the parser does not adequately verify that the length of user-supplied data fields within PSP files fits within the bounds of allocated heap buffers before performing copy operations. This allows a maliciously crafted PSP file to specify data lengths that exceed buffer boundaries, triggering a heap overflow condition.

Attack Vector

The attack vector requires local access through a malicious file. An attacker would craft a malicious PSP file containing oversized or specially structured data fields designed to trigger the buffer overflow. The attack can be delivered through several methods:

1. Email attachments - Sending malicious PSP files as attachments
2. Malicious websites - Hosting PSP files that users are tricked into downloading and opening
3. Compromised file shares - Placing malicious PSP files on shared network locations
4. Social engineering - Convincing users to open malicious files through various deception techniques

When the victim opens the malicious PSP file in GIMP, the heap overflow is triggered, allowing the attacker to potentially overwrite critical heap metadata or function pointers, ultimately achieving code execution.

The vulnerability was tracked as ZDI-CAN-28232 by the Zero Day Initiative. For technical details about the patch, refer to the GNOME GIMP Commit Update.

Detection Methods for CVE-2025-15059

Indicators of Compromise

• Presence of malformed or unusually large PSP files in user download directories or email attachments
• GIMP process crashes or abnormal termination events, particularly when opening PSP files
• Unexpected child processes spawned by GIMP or unusual network connections originating from the GIMP process
• Memory access violations or heap corruption errors logged in system event logs

Detection Strategies

• Monitor file access patterns for PSP files being opened from untrusted locations such as email attachments, temporary internet folders, or downloads
• Implement endpoint detection rules to alert on GIMP spawning unexpected child processes or shell commands
• Deploy file-based detection signatures for malformed PSP files with anomalous header or data field sizes
• Use behavior-based detection to identify heap spray techniques or memory manipulation attempts during PSP file processing

Monitoring Recommendations

• Enable detailed logging for GIMP and related image processing applications
• Monitor for unusual file access patterns involving .psp file extensions from external sources
• Implement alerting on process behavior anomalies when GIMP is running, particularly unexpected network activity or process creation
• Review crash dumps and application error logs for heap corruption indicators associated with PSP file parsing

How to Mitigate CVE-2025-15059

Immediate Actions Required

• Apply the official patch from GNOME immediately by updating GIMP to the latest patched version
• Warn users not to open PSP files from untrusted or unknown sources until patches are applied
• Consider temporarily blocking or quarantining PSP file attachments at the email gateway level
• Ensure endpoint protection solutions are updated with the latest detection signatures

Patch Information

GNOME has released a security patch to address this vulnerability. The fix is available in commit 03575ac8cbb0ef3103b0a15d6598475088dcc15e. Organizations should update GIMP installations to the latest version that incorporates this fix. For detailed patch information, refer to the GNOME GIMP Commit Update and the Zero Day Initiative Advisory ZDI-25-1196.

Workarounds

• Disable or restrict PSP file format support in GIMP if not required for business operations
• Implement application whitelisting to prevent GIMP from executing in high-risk environments until patched
• Use file type filtering at network boundaries to block or quarantine .psp files from external sources
• Run GIMP in a sandboxed environment or container to limit the impact of potential exploitation

# Example: Block PSP files at the mail gateway level (Postfix example)
# Add to /etc/postfix/mime_header_checks
/name=".*\.psp"/ REJECT PSP files blocked due to CVE-2025-15059

# Reload Postfix configuration
postfix reload