Local Code Execution Vulnerability in GIMP for MacOS

CVE-2025-8672

What is CVE-2025-8672?

The MacOS version of GIMP contains a vulnerability stemming from its bundling of a Python interpreter that retains Transparency, Consent, and Control (TCC) permissions previously granted by users to the main application. This allows an attacker with local user access to execute arbitrary commands or scripts, leveraging the granted TCC permissions to gain access to user files in privacy-protected locations without triggering user prompts. Furthermore, when accessing resources that exceed the granted permissions, the user will receive prompts that appear to be associated with GIMP, potentially obscuring the attacker's malicious activities. The issue has been remedied in the GIMP version 3.1.4.2.

References