KDE Krita Heap-Based Buffer Overflow Vulnerability in TGA File Importer

A heap-based buffer overflow vulnerability has been identified in KDE Krita versions prior to 5.2.13. The issue arises in the TGA file importer, specifically within the 'plugins/impex/tga/kis_tga_import.cpp' file. When a manipulated TGA file is loaded, the importer fails to properly handle certain pixel data, allowing for a buffer overflow in the application's memory.

Impact

Exploiting this vulnerability can lead to a heap-based buffer overflow, which may cause the application to crash or, in some cases, allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by opening a specially crafted TGA file in Krita versions prior to 5.2.13. The TGA file must be manipulated to include pixel data that the importer will incorrectly process, causing the buffer overflow.

Remediation

Users are advised to update Krita to version 5.2.13 or later. Instructions for downloading the latest version can be found on the official Krita website.