CVE-2025-2761
published 2025-04-23CVE-2025-2761: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected…
PriorityP344high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.66%
74.2th percentile
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.10.34-1+deb12u3 (bookworm) | gimp 2.10.34-1+deb12u3 (bookworm) |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 2.10.22-4+deb11u3 | 2.10.22-4+deb11u3 |
| gimp | gimp | >= 0 < 2.10.34-1+deb12u3 | 2.10.34-1+deb12u3 |
| gimp | gimp | >= 0 < 3.0.0-1 | 3.0.0-1 |
| gimp | gimp | >= 0 < 3.0.0-1 | 3.0.0-1 |
| gimp | gimp | >= 0 < 2.8.16-1ubuntu1.1+esm1 | 2.8.16-1ubuntu1.1+esm1 |
| gimp | gimp | >= 0 < 2.8.22-1ubuntu0.1~esm1 | 2.8.22-1ubuntu0.1~esm1 |
| gimp | gimp | >= 0 < 2.10.18-1ubuntu0.1+esm1 | 2.10.18-1ubuntu0.1+esm1 |
| gimp | gimp | >= 0 < 2.10.30-1ubuntu0.1+esm1 | 2.10.30-1ubuntu0.1+esm1 |
| gimp | gimp | >= 0 < 2.10.36-3ubuntu0.24.04.1+esm1 | 2.10.36-3ubuntu0.24.04.1+esm1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_ubuntu7.8HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GIMP vulnerabilities
vendor_ubuntu·2026-02-23·CVSS 7.8
CVE-2017-17785 [HIGH] GIMP vulnerabilities
Title: GIMP vulnerabilities
Summary: Several security issues were fixed in GIMP.
Hanno Böck discovered that GIMP allocated FLI images using only the
information present in the file header, which allowed for a maliciously-
crafted file to cause out-of-bounds writes. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code. This
issue only affected Ubuntu 16.04 LTS. (CVE-2017-17785)
Michael Randrianantenaina discovered that that opening a maliciously
crafted FLI file could cause GIMP to index out-of-bounds. An attacker could
possibly use this issue to cause a denial or service or execute arbitrary
code. (CVE-2025-2761)
It was discovered that opening a maliciously-crafted DCM file could cause
GIMP to index out-of-bounds. An attacker could possibly u
Red Hat
kernel: macsec: sync features on RTM_NEWLINK
vendor_redhat·2025-09-23·CVSS 5.5
CVE-2025-39874 [MEDIUM] kernel: macsec: sync features on RTM_NEWLINK
kernel: macsec: sync features on RTM_NEWLINK
In the Linux kernel, the following vulnerability has been resolved:
macsec: sync features on RTM_NEWLINK
Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES:
netdev_lock include/linux/netdevice.h:2761 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
netdev_sync_lower_features net/core/dev.c:10649 [inline]
__netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819
netdev_update_features+0x6d/0xe0 net/core/dev.c:10876
macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
netdev_features_change+0x85/0xc0 net/core/dev.c:1570
__dev_ethtool net/ethtool/ioctl.c:
Red Hat
kernel: nfsd: put dl_stid if fail to queue dl_recall
vendor_redhat·2025-04-16·CVSS 5.5
CVE-2025-22025 [MEDIUM] CWE-911 kernel: nfsd: put dl_stid if fail to queue dl_recall
kernel: nfsd: put dl_stid if fail to queue dl_recall
In the Linux kernel, the following vulnerability has been resolved:
nfsd: put dl_stid if fail to queue dl_recall
Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we
increment the reference count of dl_stid.
We expect that after the corresponding work_struct is processed, the
reference count of dl_stid will be decremented through the callback
function nfsd4_cb_recall_release.
However, if the call to nfsd4_run_cb fails, the incremented reference
count of dl_stid will not be decremented correspondingly, leading to the
following nfs4_stid leak:
unreferenced object 0xffff88812067b578 (size 344):
comm "nfsd", pid 2761, jiffies 4295044002 (age 5541.241s)
hex dump (first 32 bytes):
01 00 00 00 6b 6b 6b 6b b8 02 c0 e2 81 88 ff
Debian
CVE-2025-2761: gimp - GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. T...
vendor_debian·2025·CVSS 7.8
CVE-2025-2761 [HIGH] CVE-2025-2761: gimp - GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. T...
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.
Scope: local
bookworm: resolved (fixed in 2.10.34-1+deb12u3)
bullseye: resolved (fixed in 2.10.22-4+deb11u3)
forky: resolved (fixed in 3.0.0-1)
sid: resolved (fixed in
OSV
gimp vulnerabilities
osv·2026-02-23·CVSS 7.8
CVE-2017-17785 [HIGH] gimp vulnerabilities
gimp vulnerabilities
Hanno Böck discovered that GIMP allocated FLI images using only the
information present in the file header, which allowed for a maliciously-
crafted file to cause out-of-bounds writes. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code. This
issue only affected Ubuntu 16.04 LTS. (CVE-2017-17785)
Michael Randrianantenaina discovered that that opening a maliciously
crafted FLI file could cause GIMP to index out-of-bounds. An attacker could
possibly use this issue to cause a denial or service or execute arbitrary
code. (CVE-2025-2761)
It was discovered that opening a maliciously-crafted DCM file could cause
GIMP to index out-of-bounds. An attacker could possibly use this issue to
cause a denial of service or execute arbitra
GHSA
GHSA-x72f-pwfg-wpx2: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
ghsa_unreviewed·2025-04-23
CVE-2025-2761 [HIGH] CWE-787 GHSA-x72f-pwfg-wpx2: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.
OSV
CVE-2025-2761: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
osv·2025-04-23·CVSS 7.8
CVE-2025-2761 [HIGH] CVE-2025-2761: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-39874 kernel: macsec: sync features on RTM_NEWLINK
bugzilla·2025-09-23·CVSS 5.5
CVE-2025-39874 [MEDIUM] CVE-2025-39874 kernel: macsec: sync features on RTM_NEWLINK
CVE-2025-39874 kernel: macsec: sync features on RTM_NEWLINK
In the Linux kernel, the following vulnerability has been resolved:
macsec: sync features on RTM_NEWLINK
Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES:
netdev_lock include/linux/netdevice.h:2761 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
netdev_sync_lower_features net/core/dev.c:10649 [inline]
__netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819
netdev_update_features+0x6d/0xe0 net/core/dev.c:10876
macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
netdev_features_change+0x85/0xc0 net/core/dev.c:1570
__dev_ethtool ne
Bugzilla
CVE-2025-22025 kernel: nfsd: put dl_stid if fail to queue dl_recall
bugzilla·2025-04-16·CVSS 5.5
CVE-2025-22025 [MEDIUM] CVE-2025-22025 kernel: nfsd: put dl_stid if fail to queue dl_recall
CVE-2025-22025 kernel: nfsd: put dl_stid if fail to queue dl_recall
In the Linux kernel, the following vulnerability has been resolved:
nfsd: put dl_stid if fail to queue dl_recall
Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we
increment the reference count of dl_stid.
We expect that after the corresponding work_struct is processed, the
reference count of dl_stid will be decremented through the callback
function nfsd4_cb_recall_release.
However, if the call to nfsd4_run_cb fails, the incremented reference
count of dl_stid will not be decremented correspondingly, leading to the
following nfs4_stid leak:
unreferenced object 0xffff88812067b578 (size 344):
comm "nfsd", pid 2761, jiffies 4295044002 (age 5541.241s)
hex dump (first 32 bytes):
01 00 00 00 6b 6b 6b 6b b8 0
2025-04-23
Published