Multiple critical vulnerabilities in GIMP, including stack-based buffer overflows in the LBM file parser (CVE-2025-14423, CVSS 7.8) and an integer overflow in the WBMP parser (CVE-2025-10923, CVSS 7.8), allow remote attackers to execute arbitrary code by tricking a user into opening a malicious image file. The GIMP developers have addressed these and other related vulnerabilities in version 3.0.6, which users should upgrade to immediately. [tenable.com](https://www.tenable.com/cve/CVE-2025-14423) [heise.de](https://www.heise.de/en/news/Image-editing-GIMP-Version-3-0-6-closes-code-smuggling-leaks-10964311.html)