---
id: "CVE-2025-10935"
page: "https://infrastack.ai/live/CVE-2025-10935"
kind: "vulnerability"
aliases: ["CVE-2025-10935"]
title: "libilbm: ILBM image parsing heap overflow lets a file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "libilbm", "fixed": ["fe719677a8267c5ef7a7ff6175219587923ed82c"], "affected": "< fe71967 (commit, 2026-11-03)", "ecosystem": "github"}]
ecosystems: []
tags: ["c-library", "image-parsing", "libilbm", "package"]
not_affected_if: ["no-ilbm-input"]
published_at: "2026-11-12T03:17:08+00:00"
first_seen_at: "2026-11-12T03:46:11+00:00"
updated_at: "2026-11-12T03:54:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10935", "first_seen_at": "2026-11-12T03:46:11+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-887/", "first_seen_at": "2026-11-12T03:54:08+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-887/", "https://github.com/svanderburg/libilbm/commit/fe719677a8267c5ef7a7ff6175219587923ed82c", "https://gitlab.gnome.org/GNOME/gimp/-/issues/14817"]}]
exploit_sources: []
---

# libilbm: ILBM image parsing heap overflow lets a file run code

Link for people: https://infrastack.ai/live/CVE-2025-10935 (this .md is for agents)

libilbm is a library that reads ILBM image files. A heap buffer overflow in its parser lets an attacker run arbitrary code in the current process when a crafted file is opened.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:libilbm affected < fe71967 (commit, 2026-11-03) fixed fe719677a8267c5ef7a7ff6175219587923ed82c

## How to check

Find out whether you ship libilbm: look for libilbm in your lock files, vendored sources, Dockerfiles or distro packages (for example 'ldd <binary>' showing libilbm). If your build predates commit fe71967 (2026-11-03) and it parses ILBM/IFF files from untrusted sources, you are exposed. ZDI lists no affected version numbers. Also check if you run GIMP: the ZDI advisory links GIMP issue 14817, but no source confirms which GIMP versions embed or are affected.

## Fix

No tagged release found (the GitHub repo lists none). The maintainer fixed it in upstream commit fe719677a8267c5ef7a7ff6175219587923ed82c (2026-11-03), which adds overflow protection in byterun decompression (src/libilbm/byterun.c). Build from master at or after that commit, or take your distro's patched package.

## Timeline

- 2026-11-12T03:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-10935
- 2026-11-12T03:54:08+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-887/ — Read ZDI-26-887 (published 2026-11-06) and the maintainer fix commit; no tagged release and no affected version list exist, downstream products unconfirmed (GIMP only linked via issue 14817, page content not readable). Search and X not needed. Fix field verified from the maintainer commit.

## Documents

- [advisory] ZDI-26-887: libilbm ILBM File Parsing Heap-based Buffer Overflow https://www.zerodayinitiative.com/advisories/ZDI-26-887/
- [fix] libilbm commit fe71967: protect byterun decompression from overflowing the data array https://github.com/svanderburg/libilbm/commit/fe719677a8267c5ef7a7ff6175219587923ed82c
- [mentions] GIMP issue 14817 (CVE-2025-10935, ZDI-CAN-27792) https://gitlab.gnome.org/GNOME/gimp/-/issues/14817

## From the sources

libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_