CVE-2025-2760

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>gimp-app</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GIMP XWD File Parsing Integer Overflow Remote Code Execution
	Vulnerability. This vulnerability allows remote attackers to execute
	arbitrary code on affected installations of GIMP. User interaction is
	required to exploit this vulnerability in that the target must visit a
	malicious page or open a malicious file.

The specific flaw exists
	within the parsing of XWD files. The issue results from the lack of
	proper validation of user-supplied data, which can result in an
	integer overflow before allocating a buffer. An attacker can leverage
	this vulnerability to execute code in the context of the current
	process. Was ZDI-CAN-25082.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-2760</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-2760</url>
    </references>
    <dates>
      <discovery>2025-04-23</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>