CVE-2025-14425: 
NixOS vulnerability analysis and mitigation

CVE-2025-14425 is a heap-based buffer overflow vulnerability in GIMP's JP2 (JPEG 2000) file parsing component that allows remote attackers to execute arbitrary code. It affects GIMP version 3.0.6 (and potentially earlier versions) and was reported to the vendor on November 11, 2025, with coordinated public disclosure on December 17, 2025 via the Zero Day Initiative. The vulnerability carries a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow): GIMP fails to properly validate the length of user-supplied data before copying it into a heap-allocated buffer during JP2 file parsing. An attacker crafts a malicious JP2 file with oversized data that overflows the heap buffer, potentially enabling control over program execution flow. Exploitation requires user interaction — the target must open a malicious JP2 file or visit a page that triggers automatic file processing. The fix is available in the GNOME GitLab commit cd1c88a0364ad1444c06536731972a99bd8643fd (ZDI Advisory).

Successful exploitation allows an attacker to execute arbitrary code in the context of the GIMP process (i.e., the privileges of the logged-in user), resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files accessible to the user, modify or delete data, or crash the application. While the attack vector is local (the file must be opened on the victim's system), the vulnerability can be triggered remotely by distributing a malicious JP2 file via email, web download, or social engineering (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept exploit reference is available through the Zero Day Initiative (ZDI-25-1139), though no weaponized exploit kit or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.058%, indicating a low current probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (ZDI Advisory).

1. Craft malicious JP2 file: Create a specially crafted JPEG 2000 (.jp2) file with a malformed data field whose length exceeds the bounds of the heap buffer allocated by GIMP's JP2 parser, triggering the overflow condition.
2. Deliver the file: Distribute the malicious JP2 file to the target via email attachment, a malicious web page with an embedded or linked image, a file-sharing platform, or any other social engineering vector.
3. Induce user interaction: Trick the target user into opening the file with GIMP (e.g., by disguising it as a legitimate image or document).
4. Trigger the overflow: When GIMP parses the JP2 file, the lack of length validation causes heap memory corruption, overwriting adjacent heap metadata or function pointers.
5. Achieve code execution: Leverage the heap corruption to redirect execution flow to attacker-controlled shellcode or a ROP chain, executing arbitrary code in the context of the GIMP process and the current user's privileges (ZDI Advisory).

• File System: Presence of unexpected or suspicious .jp2 files in download directories, temporary folders, or email attachment staging areas; new or modified files in the user's home directory shortly after opening a JP2 file in GIMP.
• Process: Unusual child processes spawned by the GIMP process (e.g., sh, bash, cmd.exe, curl, wget, python) following the opening of a JP2 file; GIMP process crashing unexpectedly with a segmentation fault or heap corruption error.
• Logs: Application crash logs or core dumps referencing GIMP's JP2 parsing code; system logs showing unexpected network connections initiated by the GIMP process after file open events.

GIMP has issued a patch addressing this vulnerability, available via the GitLab commit cd1c88a0364ad1444c06536731972a99bd8643fd. Users should update GIMP to the latest patched version immediately. Red Hat has addressed this issue across multiple RHEL 9 variants via errata RHSA-2026:0914, RHSA-2026:1511, RHSA-2026:1585, RHSA-2026:1586, and RHSA-2026:1587; Debian (DLA-4431-1), Ubuntu (USN-8057-1), and Mageia (MGASA-2026-0012) have also released updates. As a workaround prior to patching, avoid opening JP2 files from untrusted sources in GIMP, and consider disabling JP2 file type associations or using application sandboxing for image processing (ZDI Advisory, Red Hat Bugzilla).

The vulnerability was discovered anonymously and disclosed through Trend Micro's Zero Day Initiative program following coordinated disclosure with the GIMP project. Red Hat triaged the issue as high severity and issued multiple errata across RHEL 9 variants. Coverage appeared in Linux security news outlets and community blogs, with Debian, Ubuntu, Mageia, and SUSE all issuing advisories. No significant controversy or notable researcher commentary beyond standard patch advisories has been observed (ZDI Advisory, Red Hat Bugzilla).