This advisory covers seven distinct remote code execution vulnerabilities in GIMP 2.8 related to improper parsing of several image file formats. The flaws include heap-based buffer overflows (CVE-2025-10922, CVE-2025-10921, CVE-2025-10934), stack-based buffer overflow (CVE-2025-10925), integer overflows (CVE-2025-10923, CVE-2025-10924), and an out-of-bounds write (CVE-2025-10920). These vulnerabilities could allow an attacker to execute arbitrary code remotely by crafting malicious image files. The issues affect the gimp:2.8 module as distributed in Red Hat Enterprise Linux 8 and its extended life cycle variants. Red Hat has released updated packages to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems by tricking users into opening specially crafted image files. This could lead to full compromise of the affected system. The vulnerabilities affect multiple image parsing components, increasing the attack surface. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for the gimp:2.8 module in Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the update as soon as possible to remediate the issues. For detailed instructions on applying the update, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.