CVE-2025-10924

A remote code execution (RCE) vulnerability exists in GIMP’s FF file parsing functionality. The flaw stems from improper validation of user-supplied data, leading to an integer overflow before buffer allocation. When a user opens a malicious FF image file, the overflow can cause incorrect memory allocation, allowing arbitrary code execution within the context of the GIMP process. Successful exploitation requires user interaction, such as opening a crafted file, making it a local attack vector with remote delivery potential.

While the flaw enables arbitrary code execution, it’s rated Important instead of Critical because user interaction is mandatory, and the attack surface is limited to file parsing within GIMP. The vulnerability cannot be exploited without convincing a user to open a specially crafted FF file, and it doesn’t allow network-based exploitation without local execution. Furthermore, GIMP typically operates within user space with non-privileged permissions, reducing the potential for full system compromise. Therefore, despite the high impact on confidentiality, integrity, and availability, the exploitability conditions lower its overall severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.