TL;DR

GIMP's XWD file parsing has an OOB write flaw allowing RCE with user interaction needed. CVE: CVE-2026-2045

What happened

['GIMP suffers from a critical out-of-bounds write vulnerability in its XWD file parser', 'This issue allows attackers to execute arbitrary code remotely if users interact with malicious content']

Why it matters for ops

['User interaction required, posing less immediate threat but necessitating prompt updates', 'High CVSS score indicates severe potential impact on affected systems']

Mitigation

  • Upgrade to the latest GIMP version with security patches applied immediately
  • Avoid handling untrusted XWD files until updates are installed

Action items

  • Check for and install available software updates
  • Monitor system logs for signs of exploitation attempts

Detection IOCs

  • Unexpected crashes when opening specific XWD files
  • Unusual network traffic or requests related to malicious files

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-119/