Skip to content
Fencer Vulns
high 7.3

CVE-2025-48797 json

Gimp: multiple heap buffer overflows in tga parser

published 2025-05-27 17 mo ago modified 2026-11-04 4 d ago also EUVD-2025-16288

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 2:2.8.22-1.el7_9.2
  • Red Hat Red Hat Enterprise Linux 8 8100020250614205641.4c9c024f
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020250618101631.c3a0935b
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020250618100956.70584597
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250618100419.6af1eaf0
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250618100419.6af1eaf0
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250618100419.6af1eaf0
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020250623120629.0621e4ee
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020250623120629.0621e4ee
  • Red Hat Red Hat Enterprise Linux 9 2:2.99.8-4.el9_6.2
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 2:2.99.8-3.el9_0.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2:2.99.8-4.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 2:2.99.8-4.el9_4.1
  • gimp Debian 12 2.10.34-1+deb12u3
  • gimp Debian 14, Debian 13 3.0.0~RC1-4

debian advisories DEBIAN-CVE-2025-48797

  • gimp Ubuntu Pro 16.04 LTS 2.8.16-1ubuntu1.1+esm2
  • gimp Ubuntu Pro 18.04 LTS 2.8.22-1ubuntu0.1~esm2
  • gimp Ubuntu Pro 20.04 LTS 2.10.18-1ubuntu0.1+esm2
  • gimp Ubuntu Pro 22.04 LTS 2.10.30-1ubuntu0.1+esm2
  • gimp Ubuntu Pro 24.04 LTS 2.10.36-3ubuntu0.24.04.1+esm2

ubuntu advisories UBUNTU-CVE-2025-48797

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • gimp RHEL 8 2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2
  • pygtk2 RHEL 8 2.24.0-25.module+el8.9.0+21228+8e80d31d
  • gimp-libs RHEL 8 2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2
  • pygobject2 RHEL 8 2.28.7-5.module+el8.10.0+22676+becd68d6
  • python2-cairo RHEL 8 1.16.3-7.module+el8.10.0+22676+becd68d6
  • pygtk2-codegen RHEL 8 2.24.0-25.module+el8.9.0+21228+8e80d31d
  • python2-pycairo RHEL 8 1.16.3-7.module+el8.10.0+22676+becd68d6
  • gimp-devel-tools RHEL 8 2:2.8.22-26.module+el8.10.0+23269+4b36efb0.2

red hat advisories RHSA-2025:9569RHSA-2025:9501RHSA-2025:9316RHSA-2025:9315RHSA-2025:9314RHSA-2025:9310

  • gimp SLE Workstation Extension 15 SP7, SLE Workstation Extension 15 SP6, SLE Module for Package Hub 15 SP7 +2 more 2.10.30-150400.3.20.1

suse advisories SUSE-SU-2025:02164-1

  • gimp AlmaLinux 9 2:2.99.8-4.el9_6.2
  • gimp-libs AlmaLinux 9 2:2.99.8-4.el9_6.2
  • gimp AlmaLinux 8 2:2.8.22-26.module_el8.10.0+4017+5eb23531.2
  • pygtk2 AlmaLinux 8 2.24.0-25.module_el8.9.0+3725+d1441900
  • gimp-libs AlmaLinux 8 2:2.8.22-26.module_el8.10.0+4017+5eb23531.2
  • pygobject2 AlmaLinux 8 2.28.7-5.module_el8.10.0+3952+571e801c
  • python2-cairo AlmaLinux 8 1.16.3-7.module_el8.10.0+3952+571e801c
  • pygtk2-codegen AlmaLinux 8 2.24.0-25.module_el8.9.0+3725+d1441900

almalinux advisories ALSA-2025:9162ALSA-2025:9165

  • gimp Rocky Linux 9 2:2.99.8-4.el9_6.2
  • gimp Rocky Linux 8 2:2.8.22-26.module+el8.10.0+1927+52edb5a0
  • gimp Rocky Linux 8 2:2.8.22-26.module+el8.10.0+1998+a08ccc48.2
  • pygtk2 Rocky Linux 8 2.24.0-25.module+el8.9.0+1723+9bc93544
  • pygobject2 Rocky Linux 8 2.28.7-5.module+el8.10.0+1927+52edb5a0
  • python2-pycairo Rocky Linux 8 1.16.3-7.module+el8.10.0+1927+52edb5a0

rocky linux advisories RLSA-2025:9162RLSA-2025:9165

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-48797 updated cvss 7.3

gimp: Multiple heap buffer overflows in TGA parser

  • Red Hat Enterprise Linux 6 gimp, gimp-libs, gimp-devel-tools, gimp-help-browser
    affected: workaround, no fix planned “Currently no mitigation is available for this vulnerability.”
  • Red Hat Enterprise Linux AppStream (v. 8) pygtk2 2.24.0-25.module+el8.9.0+21228+8e80d31d, gimp 2.8.22-26.module+el8.10.0+23269+4b36efb0.2, pygobject2 2.28.7-5.module+el8.10.0+22676+becd68d6, gimp-libs 2.8.22-26.module+el8.10.0+23269+4b36efb0.2, python2-cairo 1.16.3-7.module+el8.10.0+22676+becd68d6, pygtk2-codegen 2.24.0-25.module+el8.9.0+21228+8e80d31d, +3 more
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9165
  • Red Hat Enterprise Linux AppStream (v. 9) gimp 2.99.8-4.el9_6.2, gimp-libs 2.99.8-4.el9_6.2
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9162
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) pygtk2 2.24.0-24.module+el8+2760+3d7d61b2, pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, gimp 2.8.22-16.module+el8.2.0+23304+5410b5dc.3, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, pygtk2-codegen 2.24.0-24.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, +3 more
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9310
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-16.module+el8.4.0+23302+04229f42.2, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-16.module+el8.4.0+23302+04229f42.2, +3 more
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9308
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-18.module+el8.6.0+23301+adfde0c1.2, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-18.module+el8.6.0+23301+adfde0c1.2, +3 more Red Hat Enterprise Linux AppStream E4S (v.8.6) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-18.module+el8.6.0+23301+adfde0c1.2, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-18.module+el8.6.0+23301+adfde0c1.2, +3 more
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9309
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-26.module+el8.8.0+23318+cec921ba.1, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-26.module+el8.8.0+23318+cec921ba.1, +3 more
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9569
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) gimp 2.99.8-3.el9_0.1, gimp-libs 2.99.8-3.el9_0.1
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9315
show 5 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) gimp 2.99.8-4.el9_2.1, gimp-libs 2.99.8-4.el9_2.1
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9314
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) gimp 2.99.8-4.el9_4.1, gimp-libs 2.99.8-4.el9_4.1
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9316
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-18.module+el8.6.0+23301+adfde0c1.2, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-18.module+el8.6.0+23301+adfde0c1.2, +3 more
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9309
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) pygobject2 2.28.7-4.module+el8+2760+3d7d61b2, pygtk2 2.24.0-25.module+el8.4.0+9382+ff08b506, gimp 2.8.22-26.module+el8.8.0+23318+cec921ba.1, python2-cairo 1.16.3-6.module+el8+2760+3d7d61b2, python2-pycairo 1.16.3-6.module+el8+2760+3d7d61b2, gimp-libs 2.8.22-26.module+el8.8.0+23318+cec921ba.1, +3 more
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9569
  • Red Hat Enterprise Linux Server (v. 7 ELS) gimp 2.8.22-1.el7_9.2, gimp-libs 2.8.22-1.el7_9.2 Red Hat Enterprise Linux Server Optional (v. 7 ELS) gimp 2.8.22-1.el7_9.2, gimp-libs 2.8.22-1.el7_9.2, gimp-devel-tools 2.8.22-1.el7_9.2
    fixed: vendor fix “Currently no mitigation is available for this vulnerability.” RHSA-2025:9501

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
17 mo ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.