An integer overflow vulnerability in GIMP version 3.0.4 could allow an attacker to achieve remote code execution through the processing of a specially crafted WBMP file.

The vulnerability is caused by an integer overflow in the WBMP file parsing logic, which fails to validate user-supplied data before memory allocation. An unauthenticated attacker can exploit this by enticing a user to open a malicious WBMP file.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the context of the user running the GIMP application. This could lead to a complete compromise of the local workstation, unauthorized access to sensitive user files, and potential pivot points into the broader corporate network. Given the CVSS score of 7.8, this flaw represents a significant risk to endpoint security and data integrity.

Immediate Action: Since a specific patch version is not currently listed, users should avoid opening WBMP files from untrusted sources and monitor official GIMP release channels for the upcoming security update.

Proactive Monitoring: Security teams should monitor endpoint activity for abnormal GIMP process behavior, such as unauthorized child process spawning or unexpected network connections originating from the application.

Compensating Controls: Organizations can implement endpoint protection solutions that scan incoming files for malicious characteristics and restrict the execution of untrusted software on sensitive workstations.

Public Exploit Available: No (exploit_available: false)

While there is no current evidence of active exploitation, the potential for remote code execution necessitates a high level of vigilance. Administrators should prioritize updating GIMP as soon as the vendor releases a patched version and educate users on the risks associated with opening files from unverified sources.