ZDI-26-050: GIMP ICO File Parsing Heap-based Buffer Overflow RCE

TL;DR

A critical heap-based buffer overflow flaw in GIMP can enable RCE via malicious ICO files.

What happened

['GIMP versions are vulnerable to heap-based buffer overflow', 'Attackers exploit the vulnerability through specially crafted ICO files']

Why it matters for ops

['Remote code execution possible when users open malicious files', 'Exploits require user interaction but no authentication']

Mitigation

• Update to the latest version of GIMP
• Implement strict file permissions and user access controls

Action items

• Immediately patch all systems running vulnerable versions of GIMP
• Monitor for suspicious activity related to ICO files

Detection IOCs

• Unusual network traffic from GIMP processes
• Unexpected system crashes or hangs after opening ICO files

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-050/