libilbm Heap-Based Buffer Overflow Vulnerability Allows Remote Code Execution
A heap-based buffer overflow in libilbm's ILBM file parsing, disclosed by Zero Day Initiative, enables remote code execution with user interaction.
The Zero Day Initiative has disclosed a critical heap-based buffer overflow vulnerability, tracked as ZDI-26-887, within the libilbm library's handling of ILBM files. This flaw, assigned CVE-2025-10935, carries a CVSS score of 7.8 and permits remote attackers to execute arbitrary code on vulnerable systems.
Exploitation of this vulnerability requires a degree of user interaction. Attackers can achieve code execution by enticing a victim to open a specially crafted malicious ILBM file or by directing them to a malicious webpage that triggers the vulnerable parsing code. Once initiated, the vulnerability allows attackers to execute code within the context of the current process.
The root cause of the vulnerability lies in the insufficient validation of user-supplied data length before it is copied into a heap-based buffer. This oversight allows an attacker to provide oversized data, leading to a buffer overflow condition. Successful exploitation can overwrite adjacent memory regions, potentially corrupting critical data structures or control flow information, ultimately enabling arbitrary code execution.
While the specific impact on end-users depends on the application utilizing libilbm, the potential for remote code execution is significant. Applications that process or display ILBM image files are particularly at risk if they incorporate an unpatched version of the libilbm library. The disclosure timeline indicates that the vulnerability was reported to the vendor on September 2, 2025, with a coordinated public release of the advisory on November 6, 2026.
This vulnerability highlights a common class of security flaws found in file parsing libraries. Many applications rely on third-party libraries for handling various file formats, and vulnerabilities within these libraries can have widespread implications. The lack of proper bounds checking during data processing is a recurring theme in many buffer overflow vulnerabilities.
Details regarding the fix can be found in the associated GitHub commit [https://github.com/svanderburg/libilbm/commit/fe719677a8267c5ef7a7ff6175219587923ed82c] and a related issue tracked on GitLab [https://gitlab.gnome.org/GNOME/gimp/-/work_items/14817]. Users and developers are strongly advised to review these resources and apply any available patches or mitigations to protect against potential exploitation.
The vulnerability was discovered and reported by MICHEAL RANDRIANANTENAINA, with further details available on his blog https://elkamika.blogspot.com/. The coordinated disclosure by the Zero Day Initiative ensures that vendors have an opportunity to address such flaws before they are widely exploited, though the long disclosure timeline suggests a complex patching process or extended vendor engagement.
This advisory serves as a reminder for developers to prioritize secure coding practices, especially when handling external input and parsing complex file formats. Regular security audits and prompt patching of third-party dependencies are crucial for maintaining a robust security posture against such vulnerabilities.