CVE-2025-5473

CVE-2025-5473 is an integer overflow (CWE-190) in the way GIMP parses ICO (icon) files, caused by insufficient validation of user-supplied data before writing to memory. It is triggered when a user opens a malicious ICO file or visits a malicious page that leads GIMP to process a crafted file, so user interaction is required. Successful exploitation allows a remote attacker to execute arbitrary code in the context of the current GIMP process, generally with the privileges of the logged-in user. Anyone running an affected GIMP installation that opens untrusted image files is at risk; the source data does not specify exact affected version ranges. Exploitation has not been confirmed in the wild and no public proof-of-concept is known, but EPSS assigns a 23.5% probability of exploitation within 30 days (98th percentile), and the issue was reported through the Zero Day Initiative (ZDI-CAN-26752).

What to do: Upgrade GIMP to the latest vendor release containing the ICO parser fix as soon as it is published, and check GIMP's official release notes or the ZDI advisory for the specific fixed version. Until systems are patched, do not open ICO files or untrusted images from email, downloads, or web sources with GIMP. Given the elevated EPSS score, monitor CISA KEV and vendor advisories for confirmation of active exploitation.