CVE-2025-2760
Published: 23 April 2025
Summary
CVE-2025-2760 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Gimp Gimp. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
GIMP is affected by an integer overflow vulnerability in its handling of XWD files that can lead to remote code execution. The flaw stems from insufficient validation of user-supplied data during file parsing, which produces an integer overflow prior to buffer allocation and was originally tracked as ZDI-CAN-25082.
Remote attackers can exploit the issue by supplying a malicious XWD file or directing a target to a page hosting one. Successful exploitation grants arbitrary code execution in the context of the GIMP process, although user interaction is required to open the file or visit the page. The vulnerability carries a CVSS 3.1 score of 7.8.
The Zero Day Initiative published advisory ZDI-25-203 detailing the issue, and Debian issued a related LTS announcement covering affected packages. The associated EPSS score has remained flat at 0.0949 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12177
Vulnerability details
GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious…
more
page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.