TL;DR

GIMP versions prior to the patch release contain a severe vulnerability that permits remote code execution when processing specially crafted XWD files.

What happened

['Remote attackers can exploit this flaw for RCE', 'Requires user interaction with malicious content']

Why it matters for ops

["Vulnerability in GIMP's file parsing module", 'Risk of arbitrary code execution']

Mitigation

  • Update to the latest version of GIMP
  • Avoid processing untrusted XWD files

Action items

  • Review and update affected systems
  • Educate users on risks associated with file types like XWD

Detection IOCs

  • XWD files with crafted payloads
  • Unexpected system behavior when opening XWD files

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-121/