GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27863.
The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27863.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4342-1 | gimp security update |
 Debian DSA |
DSA-6014-1 | gimp security update |
| Debian DSA |
DSA-6043-1 | gimp security update |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 29 Oct 2025 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27863. | |
| Title | GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability | |
| Weaknesses | CWE-122 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2025-10-30T03:56:08.536Z
Reserved: 2025-09-24T15:53:55.553Z
Link: CVE-2025-10922
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-29T20:15:34.923
Modified: 2025-10-29T20:15:34.923
Link: CVE-2025-10922
Redhat
No data.
OpenCVE Enrichment
No data.