CVE-2025-6035: Gimp: gimp integer overflow
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (imgbpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
Other sources
An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions (width, height) and bytes-per-pixel (imgbpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This could lead to heap corruption and potential denial-of-service (DoS) or arbitrary code execution in certain scenarios
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 2.10.34-1+deb12u4 - Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 3.0.4-2 - Upgrade
Upgrade
debian/gimpto a version that resolves this vulnerability.Fixed in 2.10.34-1+deb12u10Fixed in 3.0.4-3+deb13u10Fixed in 3.0.4-3+deb13u11Fixed in 3.2.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6035?
CVE-2025-6035 is classified as a high-severity vulnerability due to the potential for denial of service and memory corruption.
How do I fix CVE-2025-6035?
To fix CVE-2025-6035, update GIMP to the latest version where the vulnerability has been patched.
What software is affected by CVE-2025-6035?
CVE-2025-6035 specifically affects GIMP and its "Despeckle" plug-in.
What are the potential risks of CVE-2025-6035?
The risks of CVE-2025-6035 include potential crashes and memory corruption, which could lead to data loss.
When was CVE-2025-6035 discovered?
CVE-2025-6035 was reported on an unspecified date but has gained attention due to its impact on users of GIMP.