CVE-2025-48797

HighCVSS 7.3/10Last modified Jun 30, 2026

Description

A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2025
Last modified
Jun 30, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-487987.3A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attCVE-2025-487997.8Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privilegesCVE-2025-48809.8A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functiCVE-2025-488006.8Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-488026.5Improper certificate validation in Windows SMB allows an authorized attacker to perform spoofing over a network.CVE-2025-488036.7Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privilegCVE-2025-488046.8Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature CVE-2025-488057.8Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally.CVE-2025-488067.8Use after free in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally.CVE-2025-488076.7Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locallyCVE-2025-488085.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-488095.5Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose informa
CVE-2025-48797: High severity, CVSS 7.3 | Vulnix