Heap-based Buffer Overflow in GIMP XWD File Parsing

CVE-2025-10934

What is CVE-2025-10934?

A vulnerability in GIMP's parsing of XWD files allows remote attackers to execute arbitrary code on affected systems. The flaw arises from inadequate validation of the length of user-supplied data during the copying process to a heap-based buffer. Exploiting this vulnerability requires user interaction, as the target must either visit a malicious webpage or open a specially crafted XWD file. Successful exploitation can compromise the affected system, allowing attackers to execute code under the current process's context.

References