CVE-2025-8672: GIMP Privilege Escalation Vulnerability

CVE-2025-8672 Overview

CVE-2025-8672 affects the macOS build of GIMP, which bundles a Python interpreter inside the application package. The interpreter inherits any Transparency, Consent, and Control (TCC) permissions the user has previously granted to GIMP. A local attacker can invoke the bundled interpreter with arbitrary scripts and reach privacy-protected folders without triggering user prompts. Requests that exceed the granted permissions will prompt the user in the name of GIMP, concealing the attacker's intent. The issue is fixed in GIMP version 3.1.4.2. This weakness is classified as Incorrect Default Permissions [CWE-276].

Critical Impact
Local attackers can abuse GIMP's inherited TCC grants to read files in privacy-protected locations such as Documents, Downloads, or Desktop, and issue new prompts under GIMP's identity.

Affected Products

GIMP for macOS versions prior to 3.1.4.2
Apple macOS (any version enforcing TCC)
Systems where the user granted GIMP access to privacy-protected folders

Discovery Timeline

2025-08-11 - CVE-2025-8672 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-8672

Vulnerability Analysis

GIMP's macOS distribution ships with a full Python interpreter inside the application bundle to support scripting and plug-ins. macOS enforces per-application privacy controls through TCC, which grants file and device access based on the code-signing identity of the requesting binary. Because the bundled interpreter runs under GIMP's bundle identity, it inherits every TCC grant already assigned to GIMP.

An attacker who has local access to the user account can execute the interpreter directly and run arbitrary Python code with those inherited grants. Files in Documents, Downloads, Desktop, or other protected locations become accessible without a new consent prompt. When the attacker requests resources beyond the existing grants, macOS displays the prompt attributed to GIMP, giving the request a legitimate appearance.

Root Cause

The root cause is Incorrect Default Permissions [CWE-276]. The bundled Python binary lacks a distinct code-signing identity or hardened runtime configuration that would prevent it from acting as a general-purpose interpreter under GIMP's TCC entitlements. Any process launched from the bundle receives the same privacy authorizations, so scripting was never isolated from the host application's identity.

Attack Vector

Exploitation requires local access to a user session where GIMP has been granted TCC permissions. The attacker locates the bundled interpreter within the GIMP application package and invokes it directly from a shell, launch agent, or malicious script. See the CERT.PL TCC bypass analysis and the upstream GNOME GIMP issue #13848 for reference behavior. The Jamf write-up on XCSSET TCC bypasses documents similar patterns in real-world macOS malware.

Detection Methods for CVE-2025-8672

Indicators of Compromise

Execution of python or python3 binaries from paths inside /Applications/GIMP.app/Contents/ or user-installed GIMP bundles
Child processes of GIMP that read files under ~/Documents, ~/Downloads, ~/Desktop, or iCloud Drive without a user-initiated GIMP action
Unexpected TCC prompts attributed to GIMP outside normal user interaction

Detection Strategies

Alert on non-interactive launches of the GIMP-bundled Python interpreter, especially from shells, launchd agents, or scripting utilities
Correlate GIMP process ancestry with file reads in privacy-protected directories to surface script-driven access
Baseline normal GIMP plug-in activity so anomalous Python invocations stand out

Monitoring Recommendations

Ingest macOS Endpoint Security telemetry covering ES_EVENT_TYPE_NOTIFY_EXEC and file-open events for GIMP subprocesses
Monitor changes to the TCC.db database and prompt history for entries created under GIMP's bundle identifier
Track installed GIMP versions across the fleet and flag hosts still running builds prior to 3.1.4.2

How to Mitigate CVE-2025-8672

Immediate Actions Required

Upgrade all macOS installations of GIMP to version 3.1.4.2 or later
Review and revoke unnecessary TCC grants previously assigned to GIMP under System Settings → Privacy & Security
Restrict local user accounts that do not require GIMP scripting from executing the bundled interpreter

Patch Information

The vendor fixed the issue in GIMP 3.1.4.2. Track the fix and packaging status through the GNOME GIMP macOS build project and the upstream issue tracker.

Workarounds

Remove or restrict execute permissions on the bundled Python interpreter inside the GIMP application package if patching is delayed
Reset TCC entries for GIMP to force fresh, minimal consent prompts using tccutil reset All org.gimp.gimp
Deploy application-allowlisting controls that prevent non-GIMP callers from launching binaries inside the GIMP bundle

bash

# Reset TCC permissions granted to GIMP and verify installed version
tccutil reset All org.gimp.gimp
mdls -name kMDItemVersion /Applications/GIMP.app