CVE-2023-44444

Deeper analysis

GIMP contains an off-by-one vulnerability in its PSP file parser that permits remote code execution on affected installations. The flaw occurs when the parser calculates a write location inside a heap buffer while processing specially crafted data inside a PSP image; successful exploitation grants arbitrary code execution in the context of the GIMP process. The issue was originally reported as ZDI-CAN-22097 and carries a CVSS 3.0 base score of 7.8.

An attacker can exploit the weakness by supplying a malicious PSP file that the victim must open, either directly or by visiting a page that delivers the file. No other privileges are required beyond the ability to induce the user to open the crafted image, after which the attacker gains code execution under the privileges of the running GIMP instance.

The GIMP 2.10.36 release notes and the corresponding Zero Day Initiative advisory ZDI-23-1591 indicate that the vulnerability is resolved in that version; Debian subsequently included the fix in its LTS updates. The EPSS score has remained at 0.5179 since disclosure with no material increase observed.