CVE-2025-14422: 
NixOS vulnerability analysis and mitigation

CVE-2025-14422 is an integer overflow vulnerability in GIMP's PNM file parsing mechanism that allows remote attackers to execute arbitrary code on affected installations. The flaw was reported to the vendor on November 11, 2025, and publicly disclosed on December 17, 2025, via a coordinated Zero Day Initiative advisory (ZDI-25-1136). It affects GIMP 3.0.6 and was assigned a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in GIMP's PNM file parser, where user-supplied data is not properly validated before being used to calculate a buffer allocation size. When the integer overflows, an undersized buffer is allocated, creating conditions for memory corruption that can be leveraged for arbitrary code execution. Exploitation requires local access in the sense that the attack vector is file-based — a victim must open a maliciously crafted PNM file or visit a malicious page that triggers the file to be processed. The fix is available in the GNOME GitLab repository (ZDI Advisory, GNOME GitLab Commit).

Successful exploitation allows an attacker to execute arbitrary code in the context of the GIMP process running under the victim's user account, resulting in high confidentiality, integrity, and availability impact. This could lead to full compromise of the user's session, access to sensitive files readable by that user, and potential for further lateral movement within the system. The scope is limited to the current process and does not inherently escalate to kernel-level privileges, but the impact on the affected workstation is severe (ZDI Advisory).

A proof-of-concept exploit reference is listed in the ZDI advisory (ZDI-CAN-28273), but no public weaponized exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (ZDI Advisory). The vulnerability was discovered by an anonymous researcher and disclosed through the Zero Day Initiative coordinated disclosure process. The EPSS score is approximately 0.063%, indicating a low current probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious PNM file: Create a specially crafted PNM (Portable anymap) file with manipulated header values (e.g., width/height fields) designed to trigger an integer overflow when GIMP calculates the required buffer size during parsing.
2. Deliver the file to the target: Distribute the malicious PNM file via email attachment, a malicious web page with an embedded download link, or a shared file system — any vector that causes the victim to open the file with GIMP.
3. Trigger user interaction: Convince the target user to open the malicious PNM file in GIMP (e.g., by disguising it with a benign-looking filename or embedding it in a document workflow).
4. Exploit the integer overflow: When GIMP parses the PNM file, the malformed header causes an integer overflow in the buffer size calculation, resulting in an undersized heap buffer being allocated.
5. Achieve code execution: The subsequent write of image data beyond the allocated buffer corrupts adjacent heap memory, which an attacker can leverage to redirect execution flow and run arbitrary code in the context of the GIMP process (ZDI Advisory, GNOME GitLab Commit).

• File System: Presence of unexpected or suspicious .pnm, .pbm, .pgm, or .ppm files in download directories, temp folders, or email attachment staging areas; unexpected files written to disk by the GIMP process after opening an image.
• Process: Unusual child processes spawned by the GIMP process (e.g., bash, sh, curl, wget, python) following the opening of a PNM file; GIMP process exhibiting abnormal memory usage or crashing with segmentation faults.
• Network: Unexpected outbound network connections originating from the GIMP process to external IP addresses, particularly shortly after a PNM file is opened.
• Logs: Application crash logs or core dumps associated with GIMP's PNM file parsing; system logs showing unusual process creation events parented to the GIMP executable.

GIMP has issued a patch addressing this vulnerability; users should update to the latest available GIMP release that includes the fix committed to the GNOME GitLab repository (GNOME GitLab Commit). Red Hat has released multiple errata addressing this issue across RHEL 7, 8, and 9 variants (RHSA-2026:0914, RHSA-2026:1511, RHSA-2026:1574, RHSA-2026:1584 through RHSA-2026:1591) (Red Hat Bugzilla). Debian (DLA-4431-1), Ubuntu (USN-8075-1), Mageia (MGASA-2026-0012), and Amazon Linux 2 (ALAS2GIMP-2026-010) have also released security updates. As a workaround, users should avoid opening PNM files from untrusted sources and consider using file sandboxing or application isolation when processing untrusted image files.

The vulnerability was reported anonymously through the Zero Day Initiative and disclosed in a coordinated manner on December 17, 2025 (ZDI Advisory). Red Hat triaged the issue as high severity and rapidly issued patches across multiple RHEL versions within approximately one month of public disclosure (Red Hat Bugzilla). No significant public researcher commentary or notable social media discussion has been identified beyond standard vulnerability tracking and Linux distribution security advisories.