Remote Code Execution Vulnerability in GIMP DCM File Parsing

CVE-2025-10922

What is CVE-2025-10922?

A heap-based buffer overflow vulnerability exists within GIMP's handling of DCM files, allowing remote attackers to execute arbitrary code. The flaw arises due to inadequate validation of the length of user-supplied data before it is copied to a buffer in memory. To exploit this vulnerability, an attacker must convince a user to visit a malicious page or open a specially crafted file. Successful exploitation could allow the attacker to execute code in the context of the current process, potentially compromising the system.

References