# CVE-2025-14422: gimp: This update for gimp fixes the following issues:  - CVE-2025-14422: Fixed RCE vulnerability due to PNM file parsing i...

CVE-2025-14422 is fixed in 18 products on 1 platform, first by gimp 2.8.22-1ubuntu0.1~esm2, released December 23, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-14422
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0062
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 23, 2025

## Description

This update for gimp fixes the following issues:  - CVE-2025-14422: Fixed RCE vulnerability due to PNM file parsing integer overflow (bsc#1255293) - CVE-2025-14425: Fixed RCE vulnerability due to JP2 file parsing heap-based buffer overflow (bsc#1255296)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | gimp Debian 12.15 (bookworm) | 2.10.34-1+deb12u6 | [DSA-6093-1](https://patchblox.com/security/data/fix/linux/dsa-6093-1.md) | Jan 4, 2026 |
| Linux | gimp Debian 13.5 (trixie) | 3.0.4-3+deb13u4 | [DSA-6093-1](https://patchblox.com/security/data/fix/linux/dsa-6093-1.md) | Jan 4, 2026 |
| Linux | gimp Debian 14 | 3.2.0~RC2-1 | [DEBIAN-CVE-2025-14422](https://patchblox.com/security/data/fix/linux/debian-cve-2025-14422.md) | Dec 23, 2025 |
| Linux | gimp RHEL 8 | 2:2.8.22-26.module+el8.10.0+23914+4745738d.4 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp RHEL 9 | 2:3.0.4-1.el9_7.2 | [RHSA-2026:0914](https://patchblox.com/security/data/fix/linux/rhsa-2026-0914.md) | Jan 21, 2026 |
| Linux | gimp Ubuntu 18.04.6 LTS (bionic) | 2.8.22-1ubuntu0.1~esm2 | [gimp 2.8.22-1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gimp-2.8.22-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp Ubuntu 20.04 LTS (focal) | 2.10.18-1ubuntu0.1+esm2 | [gimp 2.10.18-1ubuntu0.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-gimp-2.10.18-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp Ubuntu 22.04.1 LTS (jammy) | 2.10.30-1ubuntu0.1+esm2 | [gimp 2.10.30-1ubuntu0.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gimp-2.10.30-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp Ubuntu 24.04.5 LTS (noble) | 2.10.36-3ubuntu0.24.04.1+esm2 | [gimp 2.10.36-3ubuntu0.24.04.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gimp-2.10.36-3ubuntu0.24.04.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp almalinux 8 | 2:2.8.22-26.module_el8.10.0+4109+804f132c.4 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp almalinux 9 | 2:3.0.4-1.el9_7.2 | [ALSA-2026:0914](https://patchblox.com/security/data/fix/linux/alsa-2026-0914.md) | Jan 21, 2026 |
| Linux | gimp ol 8 | 2:2.8.22-26.module+el8.10.0+90778+ba4a24eb.4 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp ol 9 | 2:3.0.4-1.el9_7.2 | [ELSA-2026-0914](https://patchblox.com/security/data/fix/linux/elsa-2026-0914.md) | Jan 21, 2026 |
| Linux | gimp opensuse-leap 15.6 | 2.10.30-150400.3.38.1 | [SUSE-SU-2026:0313-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0313-1.md) | Jan 28, 2026 |
| Linux | gimp opensuse-leap 16.0 | 3.0.8-bp160.1.1 | [OPENSUSE-RU-2026:20168-1](https://patchblox.com/security/data/fix/linux/opensuse-ru-2026-20168-1.md) | Feb 3, 2026 |
| Linux | gimp rocky 8 | 2:2.8.22-26.module+el8.10.0+1927+52edb5a0 | [RLSA-2026:1574](https://patchblox.com/security/data/fix/linux/rlsa-2026-1574.md) | Jan 30, 2026 |
| Linux | gimp rocky 9 | 2:3.0.4-1.el9_7.2 | [RLSA-2026:0914](https://patchblox.com/security/data/fix/linux/rlsa-2026-0914.md) | Jan 22, 2026 |
| Linux | gimp sles 15.7 | 2.10.30-150400.3.38.1 | [SUSE-SU-2026:0313-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0313-1.md) | Jan 28, 2026 |
| Linux | gimp-data Ubuntu 18.04.6 LTS (bionic) | 2.8.22-1ubuntu0.1~esm2 | [gimp-data 2.8.22-1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gimp-data-2.8.22-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp-data Ubuntu 20.04 LTS (focal) | 2.10.18-1ubuntu0.1+esm2 | [gimp-data 2.10.18-1ubuntu0.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-gimp-data-2.10.18-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp-data Ubuntu 22.04.1 LTS (jammy) | 2.10.30-1ubuntu0.1+esm2 | [gimp-data 2.10.30-1ubuntu0.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gimp-data-2.10.30-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp-data Ubuntu 24.04.5 LTS (noble) | 2.10.36-3ubuntu0.24.04.1+esm2 | [gimp-data 2.10.36-3ubuntu0.24.04.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gimp-data-2.10.36-3ubuntu0.24.04.1-esm2.md) | Dec 23, 2025 |
| Linux | gimp-devel RHEL 8 | 2:2.8.22-26.module+el8.10.0+23914+4745738d.4 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-devel almalinux 8 | 2:2.8.22-26.module_el8.10.0+4109+804f132c.4 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-devel ol 8 | 2:2.8.22-26.module+el8.10.0+90778+ba4a24eb.4 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-devel-tools RHEL 8 | 2:2.8.22-26.module+el8.10.0+23914+4745738d.4 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-devel-tools almalinux 8 | 2:2.8.22-26.module_el8.10.0+4109+804f132c.4 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-devel-tools ol 8 | 2:2.8.22-26.module+el8.10.0+90778+ba4a24eb.4 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-libs RHEL 8 | 2:2.8.22-26.module+el8.10.0+23914+4745738d.4 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-libs RHEL 9 | 2:3.0.4-1.el9_7.2 | [RHSA-2026:0914](https://patchblox.com/security/data/fix/linux/rhsa-2026-0914.md) | Jan 21, 2026 |
| Linux | gimp-libs almalinux 8 | 2:2.8.22-26.module_el8.10.0+4109+804f132c.4 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-libs almalinux 9 | 2:3.0.4-1.el9_7.2 | [ALSA-2026:0914](https://patchblox.com/security/data/fix/linux/alsa-2026-0914.md) | Jan 21, 2026 |
| Linux | gimp-libs ol 8 | 2:2.8.22-26.module+el8.10.0+90778+ba4a24eb.4 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | gimp-libs ol 9 | 2:3.0.4-1.el9_7.2 | [ELSA-2026-0914](https://patchblox.com/security/data/fix/linux/elsa-2026-0914.md) | Jan 21, 2026 |
| Linux | libgimp2.0 Ubuntu 18.04.6 LTS (bionic) | 2.8.22-1ubuntu0.1~esm2 | [libgimp2.0 2.8.22-1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libgimp2.0-2.8.22-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | libgimp2.0 Ubuntu 20.04 LTS (focal) | 2.10.18-1ubuntu0.1+esm2 | [libgimp2.0 2.10.18-1ubuntu0.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libgimp2.0-2.10.18-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | libgimp2.0 Ubuntu 22.04.1 LTS (jammy) | 2.10.30-1ubuntu0.1+esm2 | [libgimp2.0 2.10.30-1ubuntu0.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libgimp2.0-2.10.30-1ubuntu0.1-esm2.md) | Dec 23, 2025 |
| Linux | libgimp2.0t64 Ubuntu 24.04.5 LTS (noble) | 2.10.36-3ubuntu0.24.04.1+esm2 | [libgimp2.0t64 2.10.36-3ubuntu0.24.04.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgimp2.0t64-2.10.36-3ubuntu0.24.04.1-esm2.md) | Dec 23, 2025 |
| Linux | pygobject2 RHEL 8 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2 almalinux 8 | 2.28.7-5.module_el8.10.0+3952+571e801c | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2 ol 8 | 0:2.28.7-5.module+el8.10.0+90497+ae78887f | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2 rocky 8 | 0:2.28.7-5.module+el8.10.0+1927+52edb5a0 | [RLSA-2026:1574](https://patchblox.com/security/data/fix/linux/rlsa-2026-1574.md) | Jan 30, 2026 |
| Linux | pygobject2-codegen RHEL 8 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-codegen almalinux 8 | 2.28.7-5.module_el8.10.0+3952+571e801c | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-codegen ol 8 | 0:2.28.7-5.module+el8.10.0+90497+ae78887f | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-devel RHEL 8 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-devel almalinux 8 | 2.28.7-5.module_el8.10.0+3952+571e801c | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-devel ol 8 | 0:2.28.7-5.module+el8.10.0+90497+ae78887f | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-doc RHEL 8 | 0:2.28.7-5.module+el8.10.0+22676+becd68d6 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-doc almalinux 8 | 2.28.7-5.module_el8.10.0+3952+571e801c | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygobject2-doc ol 8 | 0:2.28.7-5.module+el8.10.0+90497+ae78887f | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2 RHEL 8 | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2 almalinux 8 | 2.24.0-25.module_el8.9.0+3725+d1441900 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2 ol 8 | 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2 rocky 8 | 0:2.24.0-25.module+el8.9.0+1723+9bc93544 | [RLSA-2026:1574](https://patchblox.com/security/data/fix/linux/rlsa-2026-1574.md) | Jan 30, 2026 |
| Linux | pygtk2-codegen RHEL 8 | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-codegen almalinux 8 | 2.24.0-25.module_el8.9.0+3725+d1441900 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-codegen ol 8 | 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-devel RHEL 8 | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-devel almalinux 8 | 2.24.0-25.module_el8.9.0+3725+d1441900 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-devel ol 8 | 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-doc RHEL 8 | 0:2.24.0-25.module+el8.9.0+21228+8e80d31d | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-doc almalinux 8 | 2.24.0-25.module_el8.9.0+3725+d1441900 | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | pygtk2-doc ol 8 | 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5 | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | python2-cairo RHEL 8 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | python2-cairo almalinux 8 | 1.16.3-7.module_el8.10.0+3952+571e801c | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | python2-cairo ol 8 | 0:1.16.3-7.module+el8.10.0+90497+ae78887f | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | python2-cairo-devel RHEL 8 | 0:1.16.3-7.module+el8.10.0+22676+becd68d6 | [RHSA-2026:1574](https://patchblox.com/security/data/fix/linux/rhsa-2026-1574.md) | Jan 29, 2026 |
| Linux | python2-cairo-devel almalinux 8 | 1.16.3-7.module_el8.10.0+3952+571e801c | [ALSA-2026:1574](https://patchblox.com/security/data/fix/linux/alsa-2026-1574.md) | Jan 29, 2026 |
| Linux | python2-cairo-devel ol 8 | 0:1.16.3-7.module+el8.10.0+90497+ae78887f | [ELSA-2026-1574](https://patchblox.com/security/data/fix/linux/elsa-2026-1574.md) | Jan 29, 2026 |
| Linux | python2-pycairo rocky 8 | 0:1.16.3-7.module+el8.10.0+1927+52edb5a0 | [RLSA-2026:1574](https://patchblox.com/security/data/fix/linux/rlsa-2026-1574.md) | Jan 30, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.