A critical use after free vulnerability in GIMP version 3.0.6 allows for remote code execution when a user opens a malicious XCF file.

The vulnerability is a use after free flaw occurring during the parsing of XCF files, caused by a failure to validate object existence before performing operations. An attacker can trigger this by convincing a user to open a malicious file, leading to code execution in the context of the current process.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running GIMP. Given the CVSS score of 7.8, this poses a high risk to organizational security, as it could lead to full system compromise, data theft, or the installation of persistent malware on the affected workstation.

Immediate Action: Upgrade GIMP to the latest version as specified by the vendor advisory to incorporate the fix found in commit 5cc55d078b7fba995cef77d195fac325ee288ddd.

Proactive Monitoring: Monitor workstation file system activity and process execution logs for unusual behavior originating from the GIMP application.

Compensating Controls: Implement endpoint protection solutions that scan incoming files for malicious patterns and restrict the ability of standard users to execute unknown or untrusted software.

Public Exploit Available: Unknown

Organizations should prioritize patching GIMP installations to remediate this use after free vulnerability immediately. Because the attack requires user interaction, user awareness training regarding the risks of opening untrusted files remains a critical secondary defense layer against this class of exploit.