CVE-2025-48798: Gimp: multiple use after free in xcf parser
A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.
Other sources
GIMP prior to version 3.0.0 is vulnerable to two use-after-free bugs and one double free bug in its XCF parser. A malicious XCF file may attempt to abuse these vulnerabilities to achieve code execution.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GIMPto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48798?
CVE-2025-48798 has a critical severity rating due to its potential to lead to crashes and memory corruption in GIMP.
How do I fix CVE-2025-48798?
To fix CVE-2025-48798, update GIMP to the latest version that is beyond 3.0.0.
What is the impact of CVE-2025-48798?
The impact of CVE-2025-48798 includes the potential for use-after-free vulnerabilities that can crash the application.
Who is affected by CVE-2025-48798?
CVE-2025-48798 affects users running GIMP versions prior to 3.0.0 who open specially crafted XCF image files.
How does CVE-2025-48798 occur?
CVE-2025-48798 occurs when GIMP processes maliciously crafted XCF image files, leading to serious memory errors.