{"id":"CVE-2025-10935","kind":"vulnerability","aliases":["CVE-2025-10935"],"related":[],"title":"libilbm: ILBM image parsing heap overflow lets a file run code","description":"libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792.","summary":"libilbm is a library that reads ILBM image files. A heap buffer overflow in its parser lets an attacker run arbitrary code in the current process when a crafted file is opened.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"libilbm","fixed":["fe719677a8267c5ef7a7ff6175219587923ed82c"],"affected":"< fe71967 (commit, 2026-11-03)","ecosystem":"github"}],"ecosystems":[],"tags":["c-library","image-parsing","libilbm","package"],"not_affected_if":["no-ilbm-input"],"how_to_check":"Find out whether you ship libilbm: look for libilbm in your lock files, vendored sources, Dockerfiles or distro packages (for example 'ldd <binary>' showing libilbm). If your build predates commit fe71967 (2026-11-03) and it parses ILBM/IFF files from untrusted sources, you are exposed. ZDI lists no affected version numbers. Also check if you run GIMP: the ZDI advisory links GIMP issue 14817, but no source confirms which GIMP versions embed or are affected.","fix":"No tagged release found (the GitHub repo lists none). The maintainer fixed it in upstream commit fe719677a8267c5ef7a7ff6175219587923ed82c (2026-11-03), which adds overflow protection in byterun decompression (src/libilbm/byterun.c). Build from master at or after that commit, or take your distro's patched package.","status":"open","published_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","triaged_at":"2026-11-12T03:47:44+00:00","updated_at":"2026-11-12T03:54:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T03:47:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"libilbm: ILBM image parsing heap overflow lets a file run code","impact":"high","summary":"libilbm is a library that reads ILBM image files. A heap buffer overflow in its parser lets an attacker run arbitrary code in the current process when a crafted file is opened.","audience":"developers","category":"package","nicknames":[],"who_cares":["libilbm","image-parsing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs in the parsing process with its privileges","analyst_note":"Find the affected libilbm versions, the fixed release and which downstream products embed it; check the ZDI advisory for the ZDI-CAN-27792 details.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ilbm-input"],"who_is_affected":"Applications that link libilbm and parse ILBM files supplied by users or other untrusted sources are exposed; the sources do not name affected versions or the products that bundle it. Systems that never parse ILBM input can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4665,"output_tokens":426,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected libilbm versions, the fixed release and which downstream products embed it; check the ZDI advisory for the ZDI-CAN-27792 details.","search":"'-10935':14A,17A '-2025':13A,16A '27792':165C 'affect':82C 'allow':74C 'arbitrari':47B,79C 'attack':45B,76C,146C 'base':65C,143C 'buffer':38B,66C,144C 'c':20B 'c-librari':19B 'code':11A,48B,69C,80C,153C 'context':156C 'copi':137C 'craft':55B 'current':51B,159C 'cve':12A,15A 'data':134C 'execut':70C,78C,152C 'exist':111C 'exploit':91C 'file':9A,35B,56B,61C,107C,117C 'flaw':110C 'heap':5A,37B,64C,142C 'heap-bas':63C,141C 'ilbm':2A,33B,60C,116C 'imag':3A,23B,34B 'image-pars':22B 'instal':83C 'interact':87C 'issu':119C 'lack':123C 'length':129C 'let':7A,43B 'leverag':148C 'libilbm':1A,18A,25B,27B,59C,85C 'librari':21B,30B 'malici':101C,106C 'must':98C 'open':58B,104C 'overflow':6A,39B,67C 'packag':26B 'page':102C 'pars':4A,24B,62C,114C 'parser':42B 'prior':135C 'process':52B,160C 'proper':125C 'read':32B 'remot':68C,75C 'requir':89C 'result':120C 'run':10A,46B 'specif':109C 'suppli':133C 'target':97C 'user':86C,132C 'user-suppli':131C 'valid':126C 'visit':99C 'vulner':71C,73C,93C,150C 'within':112C 'zdi':163C 'zdi-can':162C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libilbm and open ILBM image files from users or other untrusted sources are exposed. The attacker must get someone to open a crafted file, and code runs with that process's rights. ZDI names only libilbm; it links a GIMP issue but no source confirms GIMP or any other product is affected. Systems that never parse ILBM input can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T03:54:08Z","by":"analyst","doc":"https://github.com/svanderburg/libilbm/commit/fe719677a8267c5ef7a7ff6175219587923ed82c","run_id":3702}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["libilbm"],"ptokens":["libilbm"],"labels":["clibrary","high","imageparsing","libilbm","package"],"campaign_type":null,"search_a":"'-10935':14A,17A '-2025':13A,16A 'code':11A 'cve':12A,15A 'file':9A 'heap':5A 'ilbm':2A 'imag':3A 'let':7A 'libilbm':1A,18A 'overflow':6A 'pars':4A 'run':10A","search_b":"'arbitrari':47B 'attack':45B 'buffer':38B 'c':20B 'c-librari':19B 'code':48B 'craft':55B 'current':51B 'file':35B,56B 'heap':37B 'ilbm':33B 'imag':23B,34B 'image-pars':22B 'let':43B 'libilbm':25B,27B 'librari':21B,30B 'open':58B 'overflow':39B 'packag':26B 'pars':24B 'parser':42B 'process':52B 'read':32B 'run':46B","search_c":"'27792':165C 'affect':82C 'allow':74C 'arbitrari':79C 'attack':76C,146C 'base':65C,143C 'buffer':66C,144C 'code':69C,80C,153C 'context':156C 'copi':137C 'current':159C 'data':134C 'execut':70C,78C,152C 'exist':111C 'exploit':91C 'file':61C,107C,117C 'flaw':110C 'heap':64C,142C 'heap-bas':63C,141C 'ilbm':60C,116C 'instal':83C 'interact':87C 'issu':119C 'lack':123C 'length':129C 'leverag':148C 'libilbm':59C,85C 'malici':101C,106C 'must':98C 'open':104C 'overflow':67C 'page':102C 'pars':62C,114C 'prior':135C 'process':160C 'proper':125C 'remot':68C,75C 'requir':89C 'result':120C 'specif':109C 'suppli':133C 'target':97C 'user':86C,132C 'user-suppli':131C 'valid':126C 'visit':99C 'vulner':71C,73C,93C,150C 'within':112C 'zdi':163C 'zdi-can':162C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-10935","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10935","severity":null,"published_at":"2026-11-12T03:17:08+00:00","modified_at":"2026-11-12T03:17:08+00:00","first_seen_at":"2026-11-12T03:46:11+00:00","fetched_at":"2026-11-12T03:46:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-10935:3702","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/","severity":null,"published_at":"2026-11-12T03:54:08+00:00","modified_at":"2026-11-12T03:54:08+00:00","first_seen_at":"2026-11-12T03:54:08+00:00","fetched_at":"2026-11-12T03:54:08+00:00","note":"Read ZDI-26-887 (published 2026-11-06) and the maintainer fix commit; no tagged release and no affected version list exist, downstream products unconfirmed (GIMP only linked via issue 14817, page content not readable). Search and X not needed. Fix field verified from the maintainer commit.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-887/","https://github.com/svanderburg/libilbm/commit/fe719677a8267c5ef7a7ff6175219587923ed82c","https://gitlab.gnome.org/GNOME/gimp/-/issues/14817"]}],"documents":[{"id":131568,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/","title":"ZDI-26-887: libilbm ILBM File Parsing Heap-based Buffer Overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131569,"url":"https://github.com/svanderburg/libilbm/commit/fe719677a8267c5ef7a7ff6175219587923ed82c","title":"libilbm commit fe71967: protect byterun decompression from overflowing the data array","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":131571,"url":"https://gitlab.gnome.org/GNOME/gimp/-/issues/14817","title":"GIMP issue 14817 (CVE-2025-10935, ZDI-CAN-27792)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}