CVE-2025-6035: 
NixOS vulnerability analysis and mitigation

CVE-2025-6035 is an integer overflow vulnerability in the GIMP "Despeckle" plug-in that can lead to heap corruption, denial of service (DoS), or arbitrary code execution. The flaw arises from unchecked multiplication of image dimensions (width, height, and bytes-per-pixel), resulting in insufficient memory allocation and subsequent out-of-bounds writes. It was reported on June 12, 2025, and published on June 13, 2025, affecting GIMP 2.8.0 and likely later versions in the 2.x series. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) per NVD, though ENISA's EUVD rates it 6.6 (Red Hat Bugzilla, Red Hat CVE).

The root cause is an integer overflow (CWE-190) in the Despeckle plug-in's image buffer allocation logic, where the product of width × height × img_bpp is computed without overflow checks, causing the allocated buffer to be smaller than required. This leads to an out-of-bounds write (CWE-787) into heap memory when pixel data is subsequently written beyond the allocated region. Exploitation requires a local attacker with low privileges to convince a user to open a specially crafted image file in GIMP (user interaction required). A technical deep-dive and exploitation write-up was published on Medium by researcher cy1337, and the topic was discussed on Reddit's r/netsec as a "heap overflow rediscovery and exploitation" (Medium Write-up, Reddit r/netsec).

Successful exploitation can result in heap corruption, which may lead to a denial of service (application crash) or, in certain scenarios, arbitrary code execution in the context of the user running GIMP. Confidentiality and integrity impacts are rated low, while availability impact is rated high, reflecting the primary risk of crashing or destabilizing the application. Because GIMP runs with user-level privileges, exploitation does not directly enable privilege escalation, but could be used to execute attacker-controlled code within the user's session (Red Hat Bugzilla, Red Hat CVE).

No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. A public technical write-up and exploitation analysis was published by researcher cy1337 on Medium, demonstrating heap overflow exploitation mechanics, and was shared on Reddit's r/netsec community. The EPSS score is very low at approximately 0.013%, reflecting limited automated exploitation likelihood. No threat actor attribution has been identified (Medium Write-up, Reddit r/netsec).

1. Craft a malicious image file: Create an image with dimensions (width × height × bytes-per-pixel) that, when multiplied together, cause a 32-bit integer overflow, resulting in a value smaller than the actual required buffer size.
2. Deliver the file to the target: Use social engineering, email, or a malicious download to get the victim to open the crafted image file in GIMP on a vulnerable version.
3. Trigger the Despeckle plug-in: The victim applies the Despeckle filter (Filters > Enhance > Despeckle) to the opened image, or the image is processed automatically in a workflow that invokes the plug-in.
4. Trigger integer overflow and heap allocation: The plug-in computes width × height × img_bpp without overflow protection, causing malloc() to allocate a buffer smaller than needed.
5. Out-of-bounds write: Pixel data is written beyond the allocated heap buffer, corrupting adjacent heap metadata or data structures.
6. Achieve code execution or DoS: Depending on heap layout and exploitation technique, the attacker may achieve arbitrary code execution in the GIMP process context, or cause a crash (DoS) (Medium Write-up, Red Hat Bugzilla).

• Process: GIMP process (gimp, gimp-2.10) crashing unexpectedly or producing segmentation faults when opening specific image files or applying the Despeckle filter.
• File System: Presence of unusual or unexpected image files (e.g., oversized or malformed files with extreme dimension values) in user download or temp directories.
• Logs: Application crash logs or core dumps associated with the GIMP process, particularly referencing the Despeckle plug-in or heap corruption errors.
• Network: Unexpected outbound network connections from the GIMP process following image processing (may indicate post-exploitation activity if code execution is achieved).

Users should update GIMP to a patched version as soon as one is available from their distribution. Vendor patches have been issued for SUSE (SUSE-2025-02367-1), Amazon Linux 2 (ALAS2GIMP-2025-007), Debian LTS (DLA-4342-1), Debian stable (DSA-6043-1), and Ubuntu (USN-8082-1). As a workaround, users can avoid applying the Despeckle filter to untrusted image files and refrain from opening images from unknown sources in GIMP until patched (SUSE Advisory, Amazon Linux Advisory, Ubuntu Advisory).

Researcher cy1337 published a detailed technical write-up titled "Malloc Overflow Deep Dive" on Medium, describing the heap overflow rediscovery and exploitation process, which was shared on Reddit's r/netsec and received community attention. The vulnerability was also noted in TUXEDO OS's weekly security roundup. No major vendor statements beyond Red Hat's CVE assignment and distribution-level patches have been issued (Medium Write-up, Reddit r/netsec).