LIBILBM · CVE-2025-10935 · Package
FIX → fe719677a8267c5ef7a7ff6175219587923ed82c ✓ verified
libilbm is a library that reads ILBM image files. A heap buffer overflow in its parser lets an attacker run arbitrary code in the current process when a crafted file is opened.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that link libilbm and open ILBM image files from users or other untrusted sources are exposed. The attacker must get someone to open a crafted file, and code runs with that process's rights. ZDI names only libilbm; it links a GIMP issue but no source confirms GIMP or any other product is affected. Systems that never parse ILBM input can skip it.
Not affected if no-ilbm-input
Who cares c-library, image-parsing, libilbm
ldd <binary> showing libilbm)Upgrade to fe719677a8267c5ef7a7ff6175219587923ed82c
libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.