Bug 2424766 (CVE-2025-14422)

Summary: CVE-2025-14422 gimp: GIMP: Remote Code Execution via PNM file parsing integer overflow
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability during the parsing of a malicious PNM (Portable Anymap) image file. This issue stems from insufficient validation of user-supplied data, which can lead to an integer overflow before memory allocation. Successful exploitation requires user interaction, such as opening a specially crafted file, and could result in arbitrary code execution within the context of the current process.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2424815, 2424817    
Bug Blocks:    

Description OSIDB Bzimport 2025-12-23 22:05:40 UTC
GIMP PNM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNM files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28273.

Comment 2 errata-xmlrpc 2026-01-21 07:35:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:0914 https://access.redhat.com/errata/RHSA-2026:0914

Comment 3 errata-xmlrpc 2026-01-28 20:16:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:1511 https://access.redhat.com/errata/RHSA-2026:1511

Comment 4 errata-xmlrpc 2026-01-29 11:58:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:1574 https://access.redhat.com/errata/RHSA-2026:1574

Comment 5 errata-xmlrpc 2026-01-29 13:55:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:1585 https://access.redhat.com/errata/RHSA-2026:1585

Comment 6 errata-xmlrpc 2026-01-29 14:08:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:1588 https://access.redhat.com/errata/RHSA-2026:1588

Comment 7 errata-xmlrpc 2026-01-29 14:08:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:1591 https://access.redhat.com/errata/RHSA-2026:1591

Comment 8 errata-xmlrpc 2026-01-29 14:08:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:1589 https://access.redhat.com/errata/RHSA-2026:1589

Comment 9 errata-xmlrpc 2026-01-29 14:08:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:1587 https://access.redhat.com/errata/RHSA-2026:1587

Comment 10 errata-xmlrpc 2026-01-29 14:09:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:1584 https://access.redhat.com/errata/RHSA-2026:1584

Comment 11 errata-xmlrpc 2026-01-29 14:13:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:1590 https://access.redhat.com/errata/RHSA-2026:1590

Comment 12 errata-xmlrpc 2026-01-29 14:32:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:1586 https://access.redhat.com/errata/RHSA-2026:1586