Search for vulnerabilities
Vulnerability details: VCID-9tj3-u7yc-k3eb
Vulnerability ID VCID-9tj3-u7yc-k3eb
Aliases CVE-2025-48798
Summary gimp: Multiple use after free in XCF parser
Status Published
Exploitability 0.5
Weighted Severity 6.6
Risk 3.3
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-416 Use After Free
System Score Found at
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9162
ssvc Track https://access.redhat.com/errata/RHSA-2025:9162
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9165
ssvc Track https://access.redhat.com/errata/RHSA-2025:9165
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9308
ssvc Track https://access.redhat.com/errata/RHSA-2025:9308
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9309
ssvc Track https://access.redhat.com/errata/RHSA-2025:9309
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9310
ssvc Track https://access.redhat.com/errata/RHSA-2025:9310
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9314
ssvc Track https://access.redhat.com/errata/RHSA-2025:9314
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9315
ssvc Track https://access.redhat.com/errata/RHSA-2025:9315
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9316
ssvc Track https://access.redhat.com/errata/RHSA-2025:9316
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9501
ssvc Track https://access.redhat.com/errata/RHSA-2025:9501
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2025:9569
ssvc Track https://access.redhat.com/errata/RHSA-2025:9569
cvssv3 7.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48798.json
cvssv3.1 7.3 https://access.redhat.com/security/cve/CVE-2025-48798
ssvc Track https://access.redhat.com/security/cve/CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-48798
cvssv3.1 7.3 https://bugzilla.redhat.com/show_bug.cgi?id=2368557
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2368557
cvssv3.1 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.3 https://nvd.nist.gov/vuln/detail/CVE-2025-48798
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2025:9569
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48798.json
https://api.first.org/data/v1/epss?cve=CVE-2025-48798
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48798
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2368557 https://bugzilla.redhat.com/show_bug.cgi?id=2368557
cpe:/a:redhat:enterprise_linux:8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:rhel_aus:8.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_e4s:9.0::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/a:redhat:rhel_e4s:9.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_eus:9.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_tus:8.6::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
cpe:/o:redhat:rhel_els:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_els:7
CVE-2025-48798 https://access.redhat.com/security/cve/CVE-2025-48798
CVE-2025-48798 https://nvd.nist.gov/vuln/detail/CVE-2025-48798
RHSA-2025:9162 https://access.redhat.com/errata/RHSA-2025:9162
RHSA-2025:9165 https://access.redhat.com/errata/RHSA-2025:9165
RHSA-2025:9308 https://access.redhat.com/errata/RHSA-2025:9308
RHSA-2025:9309 https://access.redhat.com/errata/RHSA-2025:9309
RHSA-2025:9310 https://access.redhat.com/errata/RHSA-2025:9310
RHSA-2025:9314 https://access.redhat.com/errata/RHSA-2025:9314
RHSA-2025:9315 https://access.redhat.com/errata/RHSA-2025:9315
RHSA-2025:9316 https://access.redhat.com/errata/RHSA-2025:9316
RHSA-2025:9501 https://access.redhat.com/errata/RHSA-2025:9501
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9162
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9162
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9165
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9165
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9308
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9308
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9309
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9309
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9310
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9310
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9314
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9314
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9315
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9315
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9316
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9316
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9501
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9501
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:9569
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/errata/RHSA-2025:9569
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48798.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2025-48798
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://access.redhat.com/security/cve/CVE-2025-48798
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2368557
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:21:28Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2368557
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-48798
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01377
EPSS Score 0.00013
Published At May 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-05-27T07:10:49.534191+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48798.json 36.0.0