CVE-2025-48796

Public on 2025-05-27
Modified on 2025-05-28
Description
A flaw was found in GIMP. The GIMP ani_load_image() function is vulnerable to a stack-based overflow. If a user opens.ANI files, GIMP may be used to store more information than the capacity allows. This flaw allows a malicious ANI file to trigger arbitrary code execution.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Gimp Extra gimp Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD CVSSv3 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2025-48796 Mitre: CVE-2025-48796