This advisory covers seven distinct remote code execution vulnerabilities in GIMP's file parsing code for DCM, ICNS, WBMP, HDR, ILBM, FF, and XWD image formats. The vulnerabilities include heap-based buffer overflows (CVE-2025-10922, CVE-2025-10921, CVE-2025-10934), stack-based buffer overflow (CVE-2025-10925), out-of-bounds write (CVE-2025-10920), and integer overflows (CVE-2025-10923, CVE-2025-10924). These flaws could be exploited by processing maliciously crafted image files, leading to remote code execution. Red Hat has issued patches for GIMP in Red Hat Enterprise Linux 9 to address these vulnerabilities as detailed in advisory RHSA-2025:21968.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems running vulnerable versions of GIMP. This poses a significant security risk, potentially leading to full system compromise. The vulnerabilities affect multiple image file parsers, increasing the attack surface. There are no known exploits in the wild at the time of this advisory.

Red Hat has released security updates for GIMP in Red Hat Enterprise Linux 9 to fix these vulnerabilities. Users should apply the updated packages (e.g., gimp-3.0.4-1.el9_7.1) as soon as possible. For detailed instructions on applying the update, refer to Red Hat's official article at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are indicated in the advisory.