CVE-2023-44442
Published: 03 May 2024
Summary
CVE-2023-44442 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Gimp Gimp. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-44442 is a heap-based buffer overflow vulnerability in GIMP's PSD file parsing code. The flaw stems from insufficient validation of the length of attacker-supplied data before it is copied into a heap buffer, enabling remote code execution on affected GIMP installations. The issue was originally reported as ZDI-CAN-22094 and carries a CVSS 3.0 score of 7.8.
An attacker can exploit the vulnerability by supplying a malicious PSD file that the victim must open, either by visiting a malicious web page or directly loading the file in GIMP. Successful exploitation grants arbitrary code execution in the context of the GIMP process.
GIMP 2.10.36 addresses the issue, as noted in the project's November 2023 release announcement and the corresponding Zero Day Initiative advisory ZDI-23-1594; Debian also published an LTS update referencing the same fix. The EPSS score currently stands at 0.6033 with no material post-disclosure rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48782
Vulnerability details
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a…
more
malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.