Skip to content
OpenAdvisories
High ALSA-2025:22417 7 CVEs

Important: gimp:2.8 security update

Published Dec 1, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

Security Fix(es):

* gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10922)
* gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2025-10920)
* gimp: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10923)
* gimp: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10921)
* gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10925)
* gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10924)
* gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 14

ReleasePackageFixed in
AlmaLinux · 8 gimp 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
AlmaLinux · 8 gimp-devel 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
AlmaLinux · 8 gimp-devel-tools 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
AlmaLinux · 8 gimp-libs 2:2.8.22-26.module_el8.10.0+4070+64105a56.3
AlmaLinux · 8 pygobject2 2.28.7-5.module_el8.10.0+3952+571e801c
AlmaLinux · 8 pygobject2-codegen 2.28.7-5.module_el8.10.0+3952+571e801c
AlmaLinux · 8 pygobject2-devel 2.28.7-5.module_el8.10.0+3952+571e801c
AlmaLinux · 8 pygobject2-doc 2.28.7-5.module_el8.10.0+3952+571e801c
AlmaLinux · 8 pygtk2 2.24.0-25.module_el8.9.0+3725+d1441900
AlmaLinux · 8 pygtk2-codegen 2.24.0-25.module_el8.9.0+3725+d1441900
AlmaLinux · 8 pygtk2-devel 2.24.0-25.module_el8.9.0+3725+d1441900
AlmaLinux · 8 pygtk2-doc 2.24.0-25.module_el8.9.0+3725+d1441900
AlmaLinux · 8 python2-cairo 1.16.3-7.module_el8.10.0+3952+571e801c
AlmaLinux · 8 python2-cairo-devel 1.16.3-7.module_el8.10.0+3952+571e801c

Vulnerabilities 7

  • High 7.8
    CVE-2025-10920

    GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the targ…

    GIMP GIMP gimp Debian
  • High 7.8
    CVE-2025-10921

    GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that th…

    GIMP GIMP gegl gegl Debian Ubuntu
  • High 7.8
    CVE-2025-10922

    GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that th…

    GIMP GIMP gimp gimp Debian Ubuntu
  • High 7.8
    CVE-2025-10923

    GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability

    GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target …

    GIMP GIMP gimp Debian
  • High 7.8
    CVE-2025-10924

    GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability

    GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target mu…

    GIMP GIMP gimp Debian
  • High 7.8
    CVE-2025-10925

    GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

    GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that …

    GIMP GIMP gimp gimp Debian Ubuntu
  • High 7.8
    CVE-2025-10934

    GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that th…

    GIMP GIMP gimp gimp Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-10920
  • report
    https://access.redhat.com/security/cve/CVE-2025-10921
  • report
    https://access.redhat.com/security/cve/CVE-2025-10922
  • report
    https://access.redhat.com/security/cve/CVE-2025-10923
  • report
    https://access.redhat.com/security/cve/CVE-2025-10924
  • report
    https://access.redhat.com/security/cve/CVE-2025-10925
  • report
    https://access.redhat.com/security/cve/CVE-2025-10934
  • report
    https://bugzilla.redhat.com/2407188
  • report
    https://bugzilla.redhat.com/2407191
  • report
    https://bugzilla.redhat.com/2407192
  • report
    https://bugzilla.redhat.com/2407194
  • report
    https://bugzilla.redhat.com/2407199
  • report
    https://bugzilla.redhat.com/2407200
  • report
    https://bugzilla.redhat.com/2407233
  • advisory
    https://errata.almalinux.org/8/ALSA-2025-22417.html