A heap-based buffer overflow exists in GIMP’s handling of ICO files, allowing an attacker to execute arbitrary code in the context of the current process. The vulnerability is triggered when untrusted ICO data is parsed without proper length validation, leading to overruns of a heap buffer. Exploitation requires user interaction—opening a crafted file or loading content from a malicious web page. The impact is full system compromise if the attacker can run code with the privileges of the user running GIMP.

Affected deployments include GIMP version 3.2.0 release candidate 1 and later releases built with the same parsing codepath. The issue is specific to the GIMP graphic editor, and no other vendors or products are listed as impacted.

The CVSS score of 8.8 classifies this flaw as high severity. While the EPSS score is below 1%, indicating a low likelihood of widespread exploitation at present, the vulnerability is not catalogued in CISA’s KEV list. Exploitation requires local user action; an attacker would need to lure the user into opening the malicious ICO or visiting a compromised site that triggers the parsing routine. Once executed, the attacker enjoys full control of the user’s environment.