CVE-2025-14423: 
NixOS vulnerability analysis and mitigation

CVE-2025-14423 is a stack-based buffer overflow vulnerability in GIMP's LBM (Interleaved Bitmap) file parser that allows remote attackers to execute arbitrary code on affected systems. The flaw was reported to the vendor on November 11, 2025, and publicly disclosed on December 17, 2025, via a coordinated Zero Day Initiative advisory (ZDI-25-1137). The vulnerability affects GIMP version 3.0.6 and was assigned a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow): GIMP's LBM file parsing code fails to validate the length of user-supplied data before copying it into a fixed-size stack buffer, enabling a classic stack overflow condition. An attacker exploits this by crafting a malicious LBM file and convincing a target user to open it in GIMP — no network-level access to the target system is required beyond delivering the file. The fix was committed to the GIMP GNOME GitLab repository and adds proper length validation prior to the buffer copy operation (ZDI Advisory, GNOME GitLab).

Successful exploitation allows an attacker to execute arbitrary code in the context of the GIMP process running under the victim's user account, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files accessible to the user, modify or delete data, or crash the application. While the scope is limited to the current process (no privilege escalation to root), the compromise of a user's session could serve as a foothold for further lateral movement within a network environment (ZDI Advisory, Red Hat Bugzilla).

The vulnerability was discovered and reported anonymously through the Zero Day Initiative program (ZDI-CAN-28311) and publicly disclosed on December 17, 2025. No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.058%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (ZDI Advisory).

1. Craft a malicious LBM file: Create a specially crafted Interleaved Bitmap (LBM) file with an oversized data field in the relevant chunk that exceeds the bounds of the target stack buffer in GIMP's LBM parser.
2. Deliver the malicious file: Distribute the crafted LBM file to the target via email attachment, a malicious web page with a download link, a shared network drive, or social engineering (e.g., disguising it as a legitimate image asset).
3. Trigger user interaction: Convince the target user to open the malicious LBM file in GIMP (e.g., by double-clicking the file or using File > Open within GIMP).
4. Overflow the stack buffer: When GIMP parses the LBM file, the lack of length validation causes the oversized user-supplied data to overflow the stack buffer, overwriting the return address or other control-flow data.
5. Achieve code execution: The overwritten return address redirects execution to attacker-controlled shellcode or a ROP chain, executing arbitrary code in the context of the GIMP process and the victim's user account (ZDI Advisory, GNOME GitLab).

• File System: Unexpected .lbm files in download directories, temporary folders, or email attachment staging areas; new or modified files in the user's home directory created around the time GIMP was opened.
• Process: Unusual child processes spawned by the GIMP process (e.g., bash, sh, curl, wget, python, nc) shortly after opening an LBM file; GIMP process crashing unexpectedly with a segmentation fault.
• Logs: Application crash logs or core dumps referencing GIMP's LBM parsing code; system logs showing unexpected network connections originating from the GIMP process PID.
• Network: Outbound connections to unknown external IP addresses or domains initiated by the GIMP process, particularly shortly after opening an LBM file.

GIMP has issued a patch addressing this vulnerability; the fix is available in the GNOME GitLab repository via commit 481cdbbb97746be1145ec3a633c567a68633c521. Red Hat Enterprise Linux 9 users should apply the update provided in security errata RHSA-2026:0914, released January 21, 2026. As a workaround where patching is not immediately possible, users should avoid opening LBM files from untrusted sources and disable automatic file preview for LBM files in file managers (GNOME GitLab, Red Hat Bugzilla).

The vulnerability was reported anonymously to Trend Micro's Zero Day Initiative and disclosed through their coordinated disclosure process. Red Hat tracked the issue via Bugzilla (Bug 2424782) and issued a security errata (RHSA-2026:0914) for RHEL 9 in January 2026. No significant broader community or social media discussion has been identified beyond standard vulnerability tracking and scanner detection updates from Qualys and Tenable (ZDI Advisory, Red Hat Bugzilla).