Log in Start free

Vulnerability · Published Aug 11, 2025 · Assigned by CERT-PL

CVE-2025-8672TCC Bypass via Inherited Permissions in Bundled Interpreter in GIMP.app

Medium 4.8

In plain English

A medium-severity incorrect default permissions in GIMP from GIMP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium
Exploit odds (30 days)0.4%top 69.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of GIMP, potentially disguising attacker's malicious intent. This issue has been fixed in 3.1.4.2 version of GIMP.

Affected products (as reported)

VendorProductVersions
GIMP GIMP 0 – before 3.1.4.2

Weakness: CWE-276 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References