GIMP: Malicious Files Can Crash or Steal Data

Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

GIMP: Malicious Files Can Crash or Steal Data

USN-8082-1

Summary

GIMP's handling of certain file types can be exploited by attackers to either crash the application or steal sensitive information. This could potentially lead to unauthorized access to your system. Update to the latest version of GIMP to protect yourself.

What to do

Update canonical gimp to version 2.8.16-1ubuntu1.1+esm3.
Update canonical gimp to version 2.8.22-1ubuntu0.1~esm3.
Update canonical gimp to version 2.10.18-1ubuntu0.1+esm3.
Update canonical gimp to version 2.10.30-1ubuntu0.1+esm3.
Update canonical gimp to version 2.10.36-3ubuntu0.24.04.1+esm3.

Affected software

Vendor	Product	Affected versions	Fix available
canonical	gimp	<= 2.8.16-1ubuntu1.1+esm3	2.8.16-1ubuntu1.1+esm3
canonical	gimp	<= 2.8.22-1ubuntu0.1~esm3	2.8.22-1ubuntu0.1~esm3
canonical	gimp	<= 2.10.18-1ubuntu0.1+esm3	2.10.18-1ubuntu0.1+esm3
canonical	gimp	<= 2.10.30-1ubuntu0.1+esm3	2.10.30-1ubuntu0.1+esm3
canonical	gimp	<= 2.10.36-3ubuntu0.24.04.1+esm3	2.10.36-3ubuntu0.24.04.1+esm3

Original title

gimp vulnerabilities

Original description

Michael Randrianantenaina discovered that GIMP incorrectly handled certain
malformed ICO files. An attacker could possibly use this to cause a denial
of service or execute arbitrary code. (CVE-2025-5473)

Seungho Kim discovered that GIMP incorrectly handled certain memory
operations when running the despeckle plugin. An attacker could possibly
use this to cause a denial of service or execute arbitrary code.
(CVE-2025-6035)

https://ubuntu.com/security/notices/USN-8082-1 Vendor Advisory
https://ubuntu.com/security/CVE-2025-5473 Third Party Advisory
https://ubuntu.com/security/CVE-2025-6035 Third Party Advisory

Published: 10 Mar 2026 · Updated: 14 Mar 2026 · First seen: 13 Mar 2026