CVE-2025-48798

A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
redhatCNA
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
Debian logo
Debian Releases
Debian Product
Codename
gimp
bullseye
vulnerable
bullseye (security)
vulnerable
bookworm
vulnerable
bookworm (security)
2.10.34-1+deb12u3
fixed
trixie
3.0.4-3
fixed
sid
3.0.4-3
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2025:9162
https://access.redhat.com/errata/RHSA-2025:9165
https://access.redhat.com/errata/RHSA-2025:9308
https://access.redhat.com/errata/RHSA-2025:9309
https://access.redhat.com/errata/RHSA-2025:9310
https://access.redhat.com/errata/RHSA-2025:9314
https://access.redhat.com/errata/RHSA-2025:9315
https://access.redhat.com/errata/RHSA-2025:9316
https://access.redhat.com/errata/RHSA-2025:9501
https://access.redhat.com/errata/RHSA-2025:9569
https://access.redhat.com/security/cve/CVE-2025-48798
https://bugzilla.redhat.com/show_bug.cgi?id=2368557