A flaw in the parsing of ICNS files allows an attacker to cause a heap-based buffer overflow by supplying data whose length is not properly validated. This results in the ability to execute arbitrary code in the context of the GIMP process. The weakness involves improper handling of buffer sizes and heap allocation, corresponding to CWE-122, CWE-131, and CWE-787. Because code is executed with the same privileges as the user running GIMP, the impact extends to full local compromise of the user’s account and potentially the machine.

The vulnerability affects the GIMP image editor, specifically version 3.0.6 as identified by the vendor. All installations running this version, or any build derived from it, are vulnerable. Users of other GIMP releases are not currently affected according to the available CNA data.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low but non-zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers need a malicious file or a page that can trigger GIMP to load an ICNS file, which requires user interaction. Thus the attack vector is local via opening a crafted file or remote via a malicious web page that forces GIMP to process an ICNS file. Successful exploitation would lead to remote code execution under the current user’s privileges.