CVE-2025-48796: GIMP ANI File RCE Vulnerability

CVE-2025-48796 Overview

CVE-2025-48796 is a stack-based buffer overflow [CWE-121] in the GNU Image Manipulation Program (GIMP). The flaw resides in the ani_load_image() function, which parses Windows Animated Cursor (.ANI) files. When a user opens a crafted ANI file, GIMP writes more data to a fixed-size stack buffer than the buffer can hold. This corruption can lead to arbitrary code execution in the context of the user running GIMP.

Critical Impact
A malicious .ANI file can trigger arbitrary code execution when opened in GIMP, compromising confidentiality, integrity, and availability of the affected system.

Affected Products

GNU Image Manipulation Program (GIMP)
Red Hat Enterprise Linux distributions shipping vulnerable GIMP builds
Any Linux, macOS, or Windows platform running affected GIMP versions with ANI file support

Discovery Timeline

2025-05-27 - CVE-2025-48796 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in the NVD database

Technical Details for CVE-2025-48796

Vulnerability Analysis

The vulnerability affects GIMP's ANI file loader. The ani_load_image() function parses the RIFF-based Windows Animated Cursor format and copies image frame data into a stack-allocated buffer without validating that the source length fits within the destination. When the file supplies size or count fields larger than the buffer's capacity, the copy operation overruns the stack frame.

Stack overflows of this class overwrite adjacent local variables, saved frame pointers, and the return address. On systems without full stack canary and Position Independent Executable (PIE) coverage, an attacker can redirect execution to attacker-controlled data. The process executes with the privileges of the user opening the file, making this a viable local code execution primitive delivered through phishing or malicious file shares.

Root Cause

The root cause is missing bounds validation between attacker-controlled length fields in the ANI header and chunks and the fixed-size buffer allocated on the stack inside ani_load_image(). The parser trusts values embedded in the untrusted file rather than clamping them against the destination capacity.

Attack Vector

Exploitation requires local user interaction. An attacker crafts a malformed .ANI file and delivers it via email attachment, web download, USB media, or a network share. When the victim opens the file in GIMP, the malformed chunk sizes trigger the overflow. No elevated privileges are required for the attacker; the payload runs as the invoking user.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the Red Hat CVE-2025-48796 Advisory and the GNOME GIMP Issue #9257.

Detection Methods for CVE-2025-48796

Indicators of Compromise

.ANI files delivered through email, chat, or web downloads that originate from untrusted sources, especially those with abnormally large chunk size fields in the RIFF header
GIMP process crashes with SIGSEGV or stack-smashing detected messages logged in journalctl, dmesg, or Application event logs shortly after opening an image file
Unexpected child processes spawned by the gimp binary, particularly shells (/bin/sh, bash, cmd.exe, powershell.exe) or network utilities

Detection Strategies

Hunt for GIMP processes launching command interpreters or establishing outbound network connections, which are anomalous for an image editor
Deploy YARA rules that identify malformed RIFF ACON structures with inconsistent chunk length fields against files at rest and in transit
Correlate endpoint telemetry for the sequence of a browser or mail client writing a .ani file followed by GIMP invocation and subsequent process anomalies

Monitoring Recommendations

Enable and monitor AppArmor, SELinux, or Windows exploit protection logs for GIMP policy violations
Track file open telemetry for .ani, .cur, and other Windows cursor formats handled by non-Windows image tools
Alert on core dumps or crash reports originating from gimp binaries across the fleet, which may indicate exploitation attempts or reconnaissance

How to Mitigate CVE-2025-48796

Immediate Actions Required

Update GIMP to the patched version distributed by your operating system vendor or the upstream GIMP project as soon as fixes are available
Restrict opening of untrusted .ANI files until patches are applied across all endpoints running GIMP
Educate users to avoid opening image files from unknown senders, particularly Windows cursor formats received on Linux and macOS systems

Patch Information

Refer to the Red Hat CVE-2025-48796 Advisory and Red Hat Bug Report #2368559 for distribution-specific patch availability. Upstream tracking is available in GNOME GIMP Issue #9257. Apply vendor updates through standard package management once released.

Workarounds

Remove or disable the ANI file plug-in from the GIMP plug-ins directory to eliminate the vulnerable code path
Apply file-type filtering at email gateways and web proxies to block inbound .ani attachments and downloads
Run GIMP inside a sandbox such as firejail, bubblewrap, or a Flatpak confinement profile to contain potential exploitation

bash

# Example: launch GIMP under a restrictive firejail profile
firejail --profile=/etc/firejail/gimp.profile --net=none gimp

# Example: remove the vulnerable ANI plug-in on Linux (path may vary)
sudo rm /usr/lib/gimp/2.10/plug-ins/file-ani/file-ani