CVE-2025-10925: 
NixOS vulnerability analysis and mitigation

GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-10925) affects GIMP version 3.0.4. The vulnerability was discovered by Michael Randrianantenaina and was disclosed on September 24th, 2025. This security flaw exists within the parsing of ILBM files in GIMP installations (Zero Day Initiative).

The vulnerability stems from a stack-based buffer overflow in the ILBM file parsing functionality. The specific issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Zero Day Initiative).

When successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. The attacker can leverage this vulnerability to execute code in the context of the current process, potentially gaining control over the affected system (Zero Day Initiative).

GIMP has issued an update to correct this vulnerability through a merge request. Users are advised to update to the latest version of GIMP that includes the security patch (Zero Day Initiative, GIMP Patch).