Gimp: multiple heap buffer overflows in tga parser
Priority LOW 34CWE-122Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 14 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix Partial gimp: 3.0.0Red Hat: 10 advisoriesRed Hat: 14 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | gimp | before 3.0.0 | 3.0.0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 2:2.8.22-1.el7_9.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8100020250614205641.4c9c024f | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 8020020250618101631.c3a0935b | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 8040020250618100956.70584597 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 8060020250618100419.6af1eaf0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 8060020250618100419.6af1eaf0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 8060020250618100419.6af1eaf0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 8080020250623120629.0621e4ee | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 8080020250623120629.0621e4ee | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2:2.99.8-4.el9_6.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 2:2.99.8-3.el9_0.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 2:2.99.8-4.el9_2.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 2:2.99.8-4.el9_4.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
- gimp Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 2:2.8.22-1.el7_9.2 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020250614205641.4c9c024f Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 8020020250618101631.c3a0935b Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020250618100956.70584597 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020250618100419.6af1eaf0 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8060020250618100419.6af1eaf0 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8060020250618100419.6af1eaf0 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8080020250623120629.0621e4ee Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8080020250623120629.0621e4ee Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_6.2 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:2.99.8-3.el9_0.1 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_2.1 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_4.1 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.2::appstream | 8.2 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.4::appstream | 8.4 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.2::appstream Versions 8.2 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
Remediation
- Fix · CNA gimp Fixed in 3.0.0
Red Hat 10 advisories
- RHSA-2025:9569 Released 2025-06-24 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.ppc64le::gimp:2.8, gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.src::gimp:2.8, gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.x86_64::gimp:2.8 +28
- Red Hat Enterprise Linux AppStream TUS (v.8.8) gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.src::gimp:2.8, gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.x86_64::gimp:2.8, gimp-devel-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.x86_64::gimp:2.8 +15
- RHSA-2025:9501 Released 2025-06-24 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux Server (v. 7 ELS) gimp-2:2.8.22-1.el7_9.2, gimp-libs-2:2.8.22-1.el7_9.2
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) gimp-2:2.8.22-1.el7_9.2, gimp-devel-2:2.8.22-1.el7_9.2, gimp-devel-tools-2:2.8.22-1.el7_9.2 +1
- RHSA-2025:9309 Released 2025-06-23 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.src::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8, gimp-devel-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8 +15
- Red Hat Enterprise Linux AppStream E4S (v.8.6) gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.aarch64::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.ppc64le::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.s390x::gimp:2.8 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.6) gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.src::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8, gimp-devel-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8 +15
Show 7 more Red Hat advisories
- RHSA-2025:9316 Released 2025-06-23 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) gimp-2:2.99.8-4.el9_4.1, gimp-libs-2:2.99.8-4.el9_4.1
- RHSA-2025:9314 Released 2025-06-23 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) gimp-2:2.99.8-4.el9_2.1, gimp-libs-2:2.99.8-4.el9_2.1
- RHSA-2025:9308 Released 2025-06-23 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) gimp-2:2.8.22-16.module+el8.4.0+23302+04229f42.2.src::gimp:2.8, gimp-2:2.8.22-16.module+el8.4.0+23302+04229f42.2.x86_64::gimp:2.8, gimp-devel-2:2.8.22-16.module+el8.4.0+23302+04229f42.2.x86_64::gimp:2.8 +15
- RHSA-2025:9310 Released 2025-06-23 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) gimp-2:2.8.22-16.module+el8.2.0+23304+5410b5dc.3.src::gimp:2.8, gimp-2:2.8.22-16.module+el8.2.0+23304+5410b5dc.3.x86_64::gimp:2.8, gimp-devel-2:2.8.22-16.module+el8.2.0+23304+5410b5dc.3.x86_64::gimp:2.8 +15
- RHSA-2025:9315 Released 2025-06-23 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) gimp-2:2.99.8-3.el9_0.1, gimp-libs-2:2.99.8-3.el9_0.1
- RHSA-2025:9165 Released 2025-06-17 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) gimp-2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2.aarch64::gimp:2.8, gimp-2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2.ppc64le::gimp:2.8, gimp-2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2.s390x::gimp:2.8 +47
- RHSA-2025:9162 Released 2025-06-17 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream (v. 9) gimp-2:2.99.8-4.el9_6.2, gimp-libs-2:2.99.8-4.el9_6.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9162
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9165
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
Show 8 more groups
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9308
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9309
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9310
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9314
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9315
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9316
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9501
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9569
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30986 Gimp: multiple use after free in xcf parserPriority LOW 34
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:9165 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:9162 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2025:9310 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:9308 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:9309 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:9309 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:9569 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:9315 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:9314 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:9316 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:9309 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:9569 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:9501 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2025:9501 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48797
- 2026-10-03 Alias added: GHSA-hrhw-58x6-vqj7
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-48797 · CVE Program
- CVE-2025-48797 · NVD
- FIRST EPSS
- GHSA-hrhw-58x6-vqj7 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-48797 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences