CVE-2025-10922

A heap-based buffer overflow vulnerability was discovered in GIMP’s DICOM (DCM) file parser. The flaw occurs because the application fails to properly validate the length of user-supplied data before copying it to a heap buffer. This can lead to arbitrary code execution when a user opens a specially crafted DCM image file.

This vulnerability is marked as Important rather than Critical, this flaw remains technically significant because it enables remote code execution through malformed image content. The vulnerability affects the file parsing layer of GIMP, meaning the malicious payload executes as soon as a crafted DCM file is opened. However, it is rated as Important instead of Critical because successful exploitation requires user interaction (e.g., manually opening a malicious file) and the attack surface is limited to local execution contexts rather than a network-exposed service. The absence of privilege escalation and the requirement for a user to interact with the file reduce the overall severity, though exploitation could still result in full process compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.