https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T02:33:22.219278+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-2760 CVE-2025-2760 — GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability 2026-09-30T02:33:22.495751+00:00

Affected: GIMP

GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.

 https://vulnerability.circl.lu/vuln/usn-8075-1 USN-8075-1 — gimp vulnerabilities 2026-09-30T02:33:22.495871+00:00

Affected: Ubuntu:Pro:16.04:LTS: gimp, Ubuntu:Pro:18.04:LTS: gimp, Ubuntu:Pro:20.04:LTS: gimp, Ubuntu:Pro:22.04:LTS: gimp, Ubuntu:Pro:24.04:LTS: gimp

Michael Randrianantenaina discovered that calculating the linear size of a DDS file could overflow on 32-bit systems. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-2760)

Michael Randrianantenaina discovered that GIMP did not perform any bounds checking when calculating an offset into XWD Colormaps. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-10934)

It was discovered that GIMP's PNM loader did not sufficiently check that the image could fit within the allocated memory, which could cause GIMP to read or write out-of-bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-14422)

It was discovered that maliciously-crafted TGA files could cause memory corruption and leave GIMP in an inconsistent state. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-48797)

It was discovered that a maliciously-crafted XCF file could cause GIMP to free the same memory region twice, or access an already freed address. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-48798)