CVE-2025-15059: 
NixOS vulnerability analysis and mitigation

CVE-2025-15059 is a heap-based buffer overflow vulnerability in GIMP's PSP (Paint Shop Pro) file parser, enabling remote attackers to execute arbitrary code on affected systems. The vulnerability was reported to the vendor on November 11, 2025, and publicly disclosed on December 29, 2025, via a coordinated Zero Day Initiative advisory (ZDI-25-1196). It affects GIMP version 3.0.6 and carries a CVSS v3.0 base score of 7.8 (High), assigned by Zero Day Initiative (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The flaw exists in GIMP's PSP file parsing logic, where user-supplied data length is not properly validated before being copied into a heap-allocated buffer, allowing an attacker to overflow the buffer with attacker-controlled content. Exploitation requires local access in the sense that the victim must open a maliciously crafted PSP file (e.g., delivered via a malicious webpage or email attachment), after which code executes in the context of the GIMP process. The upstream fix is documented in the GNOME GitLab commit 03575ac8cbb0ef3103b0a15d6598475088dcc15e (ZDI Advisory, GNOME GitLab Patch).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running GIMP, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive files accessible to the GIMP process, modify data, or cause application crashes. While the attack vector is local (requiring the user to open a file), the vulnerability can be triggered remotely by tricking a user into opening a malicious PSP file, making it a realistic threat in phishing or drive-by download scenarios (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept exploit reference is available via the Zero Day Initiative advisory (ZDI-25-1196), published December 29, 2025, though no evidence of active in-the-wild exploitation has been reported. The vulnerability was discovered by an anonymous researcher and disclosed through ZDI's coordinated disclosure process. The EPSS score is approximately 0.058%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (ZDI Advisory, Feedly).

1. Craft a malicious PSP file: Create a specially crafted Paint Shop Pro (.psp) file with a manipulated data length field in a parsed block, designed to overflow the heap buffer in GIMP's PSP parser.
2. Deliver the payload: Host the malicious PSP file on a web server or distribute it via email/phishing, enticing the target user to download and open it with GIMP.
3. Trigger the vulnerability: When the victim opens the malicious PSP file in GIMP, the parser reads the attacker-controlled length value and copies data into a heap buffer without bounds checking, causing a heap overflow.
4. Achieve code execution: By carefully controlling the overflow data (e.g., overwriting heap metadata or function pointers), the attacker redirects execution flow to attacker-supplied shellcode or a ROP chain, executing arbitrary code in the context of the GIMP process (ZDI Advisory, GNOME GitLab Patch).

• File System: Presence of unexpected or suspicious .psp files in download directories, temporary folders, or email attachment staging areas; new or modified files in GIMP's working directory created around the time of exploitation.
• Process: Unusual child processes spawned by the GIMP process (e.g., bash, sh, cmd.exe, powershell, curl, wget); GIMP process crashing or terminating unexpectedly after opening a PSP file.
• Network: Outbound network connections initiated by the GIMP process to unexpected external IP addresses or domains, particularly following the opening of a PSP file.
• Logs: Application crash logs or core dumps referencing GIMP's PSP file parsing code; system logs showing GIMP process spawning unexpected subprocesses.

GIMP has issued a patch addressing this vulnerability; the upstream fix is available in the GNOME GitLab repository (commit 03575ac8cbb0ef3103b0a15d6598475088dcc15e). Red Hat has released errata for Red Hat Enterprise Linux 9 and related Extended Update Support versions: RHSA-2026:2707, RHSA-2026:2930, RHSA-2026:2950, RHSA-2026:2953, and RHSA-2026:2969. Debian (DSA-6115-1, DLA-4483-1) and Ubuntu (USN-8057-1) have also issued security updates. Users should update GIMP to the patched version available for their distribution immediately. As a temporary workaround, avoid opening PSP files from untrusted sources and consider restricting GIMP's ability to open PSP file types until patching is complete (Red Hat Bugzilla, GNOME GitLab Patch).

The vulnerability received coverage from security news outlets including The Hacker Wire and was discussed on Mastodon's infosec.exchange community. Linux distribution security teams (Red Hat, Debian, Ubuntu, openSUSE, AlmaLinux, Rocky Linux, Oracle Linux) responded promptly with security advisories and patches within weeks of the CVE's public disclosure. Pro-Linux.de published security alerts in German covering the buffer overflow. No major threat actor attribution or widespread community controversy has been noted (ZDI Advisory).