Read the docs
TI-2025-07938 Aliases CVE-2025-8672GHSA-rr35-3558-wvf9

TCC Bypass via Inherited Permissions in Bundled Interpreter in GIMP.app

Priority LOW 22CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of GIMP, potentially disguising attacker's malicious intent. This issue has been fixed in 3.1.4.2 version of GIMP.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00364 30th percentileScored 2026-11-07
Fix Fixed GIMP (GIMP): 3.1.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GIMPGIMPbefore 3.1.4.23.1.4.2Patch availableCNA
  • GIMP VendorGIMP Affected before 3.1.4.2 Fixed in 3.1.4.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*3.0.2VulnerableGIMP
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
  • cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·GIMP
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

  • Fix · CNA GIMP (GIMP) Fixed in 3.1.4.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8672
  2. 2026-10-03 Alias added: GHSA-rr35-3558-wvf9

References

Advisory 2

Other 2

  • TI-2023-23949 Integer overflow in GIMP CVSS 3.0HIGH 7.8
  • TI-2026-42270 Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow CVSS 3.1CRITICAL 9.9
  • TI-2012-02388 Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in… CVSS 2.0HIGH 7.5
  • TI-2023-23948 Heap-based buffer overflow in GIMP CVSS 3.0HIGH 7.8
  • TI-2023-23950 GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability CVSS 3.0HIGH 7.8
  • TI-2026-54560 Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit CVSS 3.1HIGH 7.0
See all 110 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences