Vulnerability intelligence

CVE-2025-2760 is a remote code execution vulnerability affecting GIMP (GNU Image Manipulation Program) software, specifically within the parsing of XWD files. The vulnerability arises from insufficient validation of user-supplied data, which can lead to an integer overflow during buffer allocation. To exploit this vulnerability, a user must interact with a malicious webpage or open a specially crafted XWD file. Successful exploitation allows an attacker to execute arbitrary code within the context of the current process. GIMP version 3.0.0 addresses this vulnerability.

CVE-2025-2761 is a remote code execution vulnerability that affects the GIMP software, specifically during the parsing of FLI files. The vulnerability arises due to insufficient validation of user-supplied data, which can lead to an out-of-bounds write. To exploit this vulnerability, an attacker needs to trick a user into opening a malicious FLI file or visiting a malicious page. Successful exploitation of CVE-2025-2761 allows an attacker to execute arbitrary code within the context of the current process. GIMP versions prior to 3.0.0 are affected. Users are advised to upgrade to version 3.0.0 or later, where the vulnerability has been addressed.

CVE-2025-5138 is a vulnerability found in Bitwarden versions up to 2.25.1. It affects the PDF File Handler component, where manipulation leads to a cross-site scripting (XSS) vulnerability. The attack can be launched remotely, and the exploit has been publicly disclosed. The vendor was notified about the vulnerability but reportedly did not respond.