CVE-2023-44441
Published: 03 May 2024
Summary
CVE-2023-44441 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Gimp Gimp. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-44441 is a heap-based buffer overflow vulnerability in GIMP's handling of DDS image files, tracked as ZDI-CAN-22093. The flaw stems from insufficient validation of user-supplied data lengths before copying into a heap buffer during DDS parsing, enabling remote code execution on affected GIMP installations. It carries a CVSS 3.0 score of 7.8 and is classified under CWE-122.
Remote attackers can exploit the issue by supplying a malicious DDS file that a user must open or by directing the target to a malicious page containing such a file. Successful exploitation grants arbitrary code execution in the context of the running GIMP process.
Advisories from the Zero Day Initiative and GIMP project note that the vulnerability is addressed in GIMP 2.10.36, with corresponding updates referenced in Debian LTS announcements. The current EPSS score of 0.1174, with a peak of 0.1259, shows no material rise from a low baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48781
Vulnerability details
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a…
more
malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.