CVE-2025-2760: GIMP XWD File Parsing RCE Vulnerability

CVE-2025-2760 Overview

CVE-2025-2760 is an integer overflow vulnerability [CWE-190] in GIMP's XWD (X Window Dump) file parsing logic. The flaw allows attackers to execute arbitrary code in the context of the GIMP process when a user opens a crafted XWD file. Exploitation requires user interaction, such as opening a malicious file or visiting a page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-25082 and is tracked publicly as ZDI-25-203. GIMP version 2.10.38 is confirmed affected.

Critical Impact
Successful exploitation grants arbitrary code execution under the privileges of the current user, enabling local compromise of workstations used by designers, analysts, and developers.

Affected Products

GIMP 2.10.38 on Linux distributions including Debian LTS
GIMP installations bundling the affected XWD plug-in across Windows and macOS builds
Downstream packages that vendor the unpatched GIMP file-format plug-in

Discovery Timeline

2025-04-23 - CVE-2025-2760 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-2760

Vulnerability Analysis

The vulnerability resides in the GIMP plug-in that parses XWD files, a legacy format produced by the X Window Dump utility. The parser reads attacker-controlled size fields from the file header and uses them in arithmetic that determines how much memory to allocate for pixel data. Because the calculation lacks bounds checking, multiplying width, height, and bytes-per-pixel can wrap around the integer range. The undersized allocation is then filled with attacker-controlled bytes, producing a heap buffer overflow. The overflow corrupts adjacent heap metadata and allocator structures, which an attacker can shape to redirect control flow.

Root Cause

The root cause is missing validation of user-supplied dimensions and color-depth values before they are used in buffer allocation arithmetic [CWE-190]. The arithmetic operates on fixed-width integers without checked-math primitives, so values that overflow silently wrap to small positive results that pass naive size checks.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious .xwd file by email, web download, shared storage, or chat. When the victim opens the file in GIMP, or previews it through a thumbnailer that invokes the GIMP loader, the overflow is triggered and code executes in the user's context.

No verified public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-25-203 for technical details.

Detection Methods for CVE-2025-2760

Indicators of Compromise

Unexpected child processes spawned by gimp or gimp-2.10, particularly shells, scripting interpreters, or network clients
.xwd files arriving from untrusted sources, especially those with abnormally large or malformed header dimensions
Crashes or segmentation faults in GIMP coinciding with opening image files from email or download directories

Detection Strategies

Build endpoint detections that alert when gimp writes executables, modifies autostart locations, or initiates outbound network connections
Hunt for image-viewer or thumbnailer processes (tumblerd, gnome-thumbnail-factory) invoking GIMP plug-ins on attacker-supplied XWD content
Correlate file-format anomalies in .xwd files with subsequent process anomalies on the same host using EDR telemetry

Monitoring Recommendations

Centralize endpoint process and file telemetry in a security data lake to support retrospective hunting for XWD-triggered exploitation patterns
Track GIMP versions across the fleet via software inventory to identify hosts still running 2.10.38 or earlier
Monitor crash reports and core dumps referencing the XWD plug-in for evidence of exploitation attempts

How to Mitigate CVE-2025-2760

Immediate Actions Required

Upgrade GIMP to a version released after the vendor patch supersedes 2.10.38 on all workstations
Apply the Debian LTS update tracked in the Debian LTS Security Announcement for affected systems
Block or quarantine inbound .xwd attachments at email and web gateways until patching is complete

Patch Information

The GIMP project has issued fixes addressed in distribution updates, including the Debian LTS advisory published in October 2025. Administrators should consult the Zero Day Initiative Advisory ZDI-25-203 and their distribution's security tracker to confirm the fixed package version, then deploy through standard patch management.

Workarounds

Disable or remove the XWD file-format plug-in from the GIMP plug-ins directory if patching cannot be performed immediately
Instruct users not to open .xwd files from untrusted sources and disable image thumbnailers that invoke GIMP loaders
Restrict GIMP execution to standard user accounts and prevent it from running with elevated privileges

bash

# Example: remove the XWD plug-in on a Linux workstation as a temporary mitigation
sudo rm /usr/lib/gimp/2.0/plug-ins/file-xwd/file-xwd

# Verify GIMP version after patching
gimp --version