A critical integer overflow vulnerability in GIMP 3.0.4 allows for remote code execution if a user is enticed to open a specially crafted FF file.

This vulnerability is an integer overflow flaw occurring within the FF file parsing logic. It allows an unauthenticated attacker to execute arbitrary code in the context of the current user process by tricking them into opening a malicious file.

The successful exploitation of this vulnerability permits remote code execution, which could lead to full system compromise, loss of sensitive data, or unauthorized installation of persistent malware. With a CVSS score of 7.8, the risk is classified as High, reflecting the potential for significant impact on system integrity and confidentiality despite the requirement for user interaction.

Immediate Action: Review the official GNOME GitLab repository for the referenced merge request and apply all available security updates or configuration changes provided by the vendor.

Proactive Monitoring: Monitor workstation file access logs and endpoint security telemetry for unusual process behaviors originating from GIMP or associated image processing sub-tasks.

Compensating Controls: Implement endpoint protection solutions that scan incoming files for malicious patterns and restrict the ability of standard users to execute untrusted binaries or scripts.

Public Exploit Available: Unknown

The vulnerability poses a severe risk to users who interact with untrusted FF files. Organizations should prioritize updating GIMP to a secure version as soon as the vendor release becomes available. In the interim, users should exercise extreme caution when opening files from unknown or untrusted sources to prevent triggering the vulnerable parsing logic.