CVE-2025-48797

A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow.

References

Affected packages

Debian:11 / gimp

Package

Name: gimp
Purl: pkg:deb/debian/gimp?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.10.22-4

2.10.22-4+deb11u1

2.10.22-4+deb11u2

2.10.24-1

2.10.24-2

2.10.26-1

2.10.28-1

2.10.30-1

2.10.32-1

2.10.34-1

2.10.36-1

2.10.36-2

2.10.36-3

2.10.38-1

2.10.38-2

2.99.10-1

2.99.12-1

2.99.12-2

2.99.14-1

2.99.14-2

2.99.16-1

2.99.16-2

2.99.18-1

3.*

3.0.0~RC1-1

3.0.0~RC1-3

3.0.0~RC1-4

3.0.0~RC2-1

3.0.0~RC3-1

3.0.0-1

3.0.0-2

3.0.2-1

3.0.2-2

3.0.2-3

3.0.2-3.1

3.0.4-1

3.0.4-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / gimp

Package

Name: gimp
Purl: pkg:deb/debian/gimp?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.10.34-1+deb12u3

Affected versions

2.*

2.10.34-1

2.10.34-1+deb12u1

2.10.34-1+deb12u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / gimp

Package

Name: gimp
Purl: pkg:deb/debian/gimp?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.0~RC1-4

Affected versions

2.*

2.10.34-1

2.10.36-1

2.10.36-2

2.10.36-3

2.10.38-1

2.10.38-2

2.99.10-1

2.99.12-1

2.99.12-2

2.99.14-1

2.99.14-2

2.99.16-1

2.99.16-2

2.99.18-1

3.*

3.0.0~RC1-1

3.0.0~RC1-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}