GIMP Integer Overflow Vulnerability in ICO File Parsing Leading to Remote Code Execution

A remote code execution vulnerability has been identified in GIMP, specifically in the parsing of ICO files. This issue arises from improper validation of user-supplied data, allowing for an integer overflow before memory writing. As a result, remote attackers can execute arbitrary code on affected GIMP installations. Exploitation requires user interaction, such as opening a malicious ICO file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed in the context of the current process.

Remediation

GIMP has released a patch for this vulnerability in version 3.0.4. Users can download this update from the official GIMP website or through the Microsoft Store.