A critical stack-based buffer overflow in GIMP 3.0.4 may allow remote code execution when a user opens a specially crafted ILBM file.

This vulnerability is a stack-based buffer overflow (CWE-121) occurring during the parsing of ILBM files due to insufficient length validation of user-supplied data. An unauthenticated attacker can achieve remote code execution by enticing a user to open a malicious file.

The ability for an attacker to execute arbitrary code with the privileges of the GIMP process poses a severe risk to organizational assets. A successful exploit could lead to complete system compromise, unauthorized data access, or the deployment of further malicious payloads. Given the CVSS score of 7.8, this vulnerability represents a significant threat to endpoint security, particularly for workstations where GIMP is used to process untrusted files.

Immediate Action: Restrict the opening of ILBM files from untrusted sources until a security patch is released and applied. Monitor the upstream GNOME GitLab repository for the release of a fixed version.

Proactive Monitoring: Review application logs for unusual crashes or unexpected behavior when opening image files. Monitor endpoint activity for unauthorized process spawning originating from the GIMP application.

Compensating Controls: Utilize endpoint detection and response tools to identify and block suspicious file execution patterns. Ensure that users operate with the principle of least privilege to limit the potential impact of code execution.

Public Exploit Available: No (no confirmed public exploit exists in the provided data).

Users and administrators should treat this vulnerability with high priority due to its potential for full system compromise. While a direct patch is not yet identified, organizations should immediately implement strict file handling policies and monitor for anomalous software behavior. Once a fix is verified through the official GNOME repository, it should be applied across all affected installations without delay.