CVE-2025-5473
Published: 06 June 2025
Summary
CVE-2025-5473 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Gimp Gimp. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
GIMP contains an integer overflow vulnerability during the parsing of ICO image files that stems from insufficient validation of user-supplied data. The flaw, tracked as CVE-2025-5473 and originally reported as ZDI-CAN-26752, affects installations of GIMP and carries a CVSS 3.1 score of 8.8. Successful exploitation can result in remote code execution within the context of the GIMP process.
Remote attackers can trigger the issue by supplying a malicious ICO file that the victim either opens directly or encounters through a web page. No authentication is required, though user interaction is mandatory. The resulting integer overflow occurs before a memory write, allowing arbitrary code execution.
Advisories from the Zero Day Initiative and the GIMP project indicate that the vulnerability is resolved in GIMP 3.0.4. Debian has also published updated packages for affected LTS releases to address the same flaw.
EPSS scores remain low, with a current value of 0.0164 and a peak of 0.0169, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-17358
Vulnerability details
GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious…
more
page or open a malicious file. The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26752.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.