What happened
A high-severity vulnerability has been identified in GIMP, specifically affecting the PSD thumbnail resource loader. The issue involves a BGR-to-RGB channel swap with a fixed 3-byte stride that does not verify the colour space of embedded JPEG thumbnails. A crafted grayscale PSD thumbnail can trigger a heap out-of-bounds read and write within the plug-in process, potentially resulting in a crash or arbitrary code execution. Exploitation requires a user to open or browse a maliciously crafted PSD file.
Who is affected
Organisations running GIMP within the specified environment are affected. This includes systems operating with vulnerable versions of GIMP, such as those integrated into Red Hat Enterprise Linux 10, 6, 7, 8, or 9. The vulnerability’s exploitable conditions are local; it requires an attacker with local access and the victim to actively open or interact with a malicious PSD file. No remote exploitation vector has been confirmed at this time.
Recommended actions
- Implement strict access controls to prevent unauthorised local access to affected systems.
- Enforce user awareness training around opening files from untrusted sources, especially image files with complex embedded content like PSDs.
- Apply robust endpoint monitoring to detect suspicious activity related to file handling or application crashes that could indicate exploitation attempts.
- Review and control the handling of image files within protected environments to minimise the risk of locally executed malicious files.
