CVE-2025-10920

A remote code execution (RCE) vulnerability exists in GIMP due to improper bounds checking during the parsing of ICNS image files. When a user opens a specially crafted ICNS file, it can trigger an out-of-bounds write, allowing attackers to execute arbitrary code within the context of the GIMP process.

This vulnerability is rated Important rather than Moderate because it enables arbitrary code execution through a memory corruption flaw in the ICNS file parser. Although exploitation requires user interaction, the underlying issue—an out-of-bounds write—directly affects memory integrity and can allow attackers to gain control of program execution. The potential for full compromise of the application process elevates its impact beyond data exposure or denial-of-service, making it a significant security concern.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.