Gimp: multiple use after free in xcf parser
Priority LOW 34CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 14 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Partial gimp: 3.0.0Red Hat: 10 advisoriesRed Hat: 14 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | gimp | before 3.0.0 | 3.0.0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 2:2.8.22-1.el7_9.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8100020250614205641.4c9c024f | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 8020020250618101631.c3a0935b | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 8040020250618100956.70584597 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 8060020250618100419.6af1eaf0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 8060020250618100419.6af1eaf0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 8060020250618100419.6af1eaf0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 8080020250623120629.0621e4ee | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 8080020250623120629.0621e4ee | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2:2.99.8-4.el9_6.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 2:2.99.8-3.el9_0.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 2:2.99.8-4.el9_2.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 2:2.99.8-4.el9_4.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
- gimp Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 2:2.8.22-1.el7_9.2 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020250614205641.4c9c024f Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 8020020250618101631.c3a0935b Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020250618100956.70584597 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020250618100419.6af1eaf0 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8060020250618100419.6af1eaf0 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8060020250618100419.6af1eaf0 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8080020250623120629.0621e4ee Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8080020250623120629.0621e4ee Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_6.2 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:2.99.8-3.el9_0.1 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_2.1 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2:2.99.8-4.el9_4.1 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.2::appstream | 8.2 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.4::appstream | 8.4 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.2::appstream Versions 8.2 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
Remediation
- Fix · CNA gimp Fixed in 3.0.0
Red Hat 10 advisories
- RHSA-2025:9569 Released 2025-06-24 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.ppc64le::gimp:2.8, gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.src::gimp:2.8, gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.x86_64::gimp:2.8 +28
- Red Hat Enterprise Linux AppStream TUS (v.8.8) gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.src::gimp:2.8, gimp-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.x86_64::gimp:2.8, gimp-devel-2:2.8.22-26.module+el8.8.0+23318+cec921ba.1.x86_64::gimp:2.8 +15
- RHSA-2025:9501 Released 2025-06-24 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux Server (v. 7 ELS) gimp-2:2.8.22-1.el7_9.2, gimp-libs-2:2.8.22-1.el7_9.2
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) gimp-2:2.8.22-1.el7_9.2, gimp-devel-2:2.8.22-1.el7_9.2, gimp-devel-tools-2:2.8.22-1.el7_9.2 +1
- RHSA-2025:9309 Released 2025-06-23 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.src::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8, gimp-devel-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8 +15
- Red Hat Enterprise Linux AppStream E4S (v.8.6) gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.aarch64::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.ppc64le::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.s390x::gimp:2.8 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.6) gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.src::gimp:2.8, gimp-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8, gimp-devel-2:2.8.22-18.module+el8.6.0+23301+adfde0c1.2.x86_64::gimp:2.8 +15
Show 7 more Red Hat advisories
- RHSA-2025:9316 Released 2025-06-23 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) gimp-2:2.99.8-4.el9_4.1, gimp-libs-2:2.99.8-4.el9_4.1
- RHSA-2025:9314 Released 2025-06-23 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) gimp-2:2.99.8-4.el9_2.1, gimp-libs-2:2.99.8-4.el9_2.1
- RHSA-2025:9308 Released 2025-06-23 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) gimp-2:2.8.22-16.module+el8.4.0+23302+04229f42.2.src::gimp:2.8, gimp-2:2.8.22-16.module+el8.4.0+23302+04229f42.2.x86_64::gimp:2.8, gimp-devel-2:2.8.22-16.module+el8.4.0+23302+04229f42.2.x86_64::gimp:2.8 +15
- RHSA-2025:9310 Released 2025-06-23 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) gimp-2:2.8.22-16.module+el8.2.0+23304+5410b5dc.3.src::gimp:2.8, gimp-2:2.8.22-16.module+el8.2.0+23304+5410b5dc.3.x86_64::gimp:2.8, gimp-devel-2:2.8.22-16.module+el8.2.0+23304+5410b5dc.3.x86_64::gimp:2.8 +15
- RHSA-2025:9315 Released 2025-06-23 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) gimp-2:2.99.8-3.el9_0.1, gimp-libs-2:2.99.8-3.el9_0.1
- RHSA-2025:9165 Released 2025-06-17 · Red Hat rating Importantgimp:2.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) gimp-2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2.aarch64::gimp:2.8, gimp-2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2.ppc64le::gimp:2.8, gimp-2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2.s390x::gimp:2.8 +47
- RHSA-2025:9162 Released 2025-06-17 · Red Hat rating Importantgimp security update
- Red Hat Enterprise Linux AppStream (v. 9) gimp-2:2.99.8-4.el9_6.2, gimp-libs-2:2.99.8-4.el9_6.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9162
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9165
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
Show 8 more groups
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9308
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9309
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9310
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9314
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9315
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9316
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9501
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 12 more products — RHSA-2025:9569
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-30985 Gimp: multiple heap buffer overflows in tga parserPriority LOW 34
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:9165 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:9162 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2025:9310 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:9308 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:9309 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:9309 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:9569 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:9315 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:9314 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:9316 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:9309 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:9569 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:9501 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2025:9501 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48798
- 2026-10-03 Alias added: GHSA-7p2h-v67m-x5qx
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-48798 · CVE Program
- CVE-2025-48798 · NVD
- FIRST EPSS
- GHSA-7p2h-v67m-x5qx · GitHub Advisory Database · CC BY 4.0
- CVE-2025-48798 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences