An attacker can craft a JP2 image that contains an oversized data block. When GIMP parses the file, it does not verify the length of the block before copying it into a heap buffer, creating a heap-based buffer overflow that can overwrite memory and execute arbitrary code in the process. This flaw permits remote code execution with the privileges of the user running GIMP, leading to compromise of confidentiality, integrity, and availability of the victim’s system.

The vulnerability affects GIMP, specifically the 3.0.8 release. No other vendor or product versions are known to be impacted at this time.

The CVSS score of 7.8 indicates a high severity. An EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction, such as opening a malicious JP2 file or visiting a web page that triggers a file visit. If an user consents, the attacker can run arbitrary code with the user’s privileges.