CVE-2025-48798

Gimp: multiple use after free in xcf parser

State: Published
Severity: 7.3 High
Published: May 27, 2025
Updated: Jul 27, 2026
Reserved: May 26, 2025

Description

A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
gimp	before 3.0.0Affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	2:2.8.22-1.el7_9.2 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	8100020250614205641.4c9c024f and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat	8020020250618101631.c3a0935b and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	8040020250618100956.70584597 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	8060020250618100419.6af1eaf0 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	8060020250618100419.6af1eaf0 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	8060020250618100419.6af1eaf0 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	8080020250623120629.0621e4ee and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	8080020250623120629.0621e4ee and laterNot affected
Red Hat Enterprise Linux 9Red Hat	2:2.99.8-4.el9_6.2 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat	2:2.99.8-3.el9_0.1 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	2:2.99.8-4.el9_2.1 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	2:2.99.8-4.el9_4.1 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

References

RHSA-2025:9162vendor-advisory
RHSA-2025:9165vendor-advisory
RHSA-2025:9308vendor-advisory
RHSA-2025:9309vendor-advisory
RHSA-2025:9310vendor-advisory
RHSA-2025:9314vendor-advisory
RHSA-2025:9315vendor-advisory
RHSA-2025:9316vendor-advisory
RHSA-2025:9501vendor-advisory
RHSA-2025:9569vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-48798vdb-entry
RHBZ#2368557issue-tracking
https://gitlab.gnome.org/GNOME/gimp/-/issues/11822
https://lists.debian.org/debian-lts-announce/2025/10/msg00022.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.