CVE-2025-2761

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-2761
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-2761.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-2761
Downstream
Related
Published
2025-04-23T16:47:31.812Z
Modified
2026-07-11T03:53:28.584659013Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Details

GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2761.json",
    "cna_assigner": "zdi",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.10.38"
                },
                {
                    "last_affected": "2.10.38"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-787"
    ]
}
References

Affected packages

Git / github.com/gnome/gimp

Affected ranges

Type
GIT
Repo
https://github.com/gnome/gimp
Events
Introduced
a8b1173ca441283971ee48f4778e2ffd1cca7284
Last affected
a8b1173ca441283971ee48f4778e2ffd1cca7284
Database specific 
{
    "cpe": "cpe:2.3:a:gimp:gimp:2.10.38:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "2.10.38"
        },
        {
            "last_affected": "2.10.38"
        }
    ]
}

Affected versions

2.*
2.10.38
Other
GIMP_2_10_38

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-2761.json"

Git / gitlab.gnome.org/gnome/gimp

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/gimp
Events
Introduced
a8b1173ca441283971ee48f4778e2ffd1cca7284
Last affected
a8b1173ca441283971ee48f4778e2ffd1cca7284
Database specific 
{
    "cpe": "cpe:2.3:a:gimp:gimp:2.10.38:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "2.10.38"
        },
        {
            "last_affected": "2.10.38"
        }
    ]
}

Affected versions

2.*
2.10.38
Other
GIMP_2_10_38

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-2761.json"