A heap-based buffer overflow vulnerability in GIMP version 3.0.6 creates a critical risk of remote code execution if a user opens a malicious JP2 image file.

This vulnerability is a heap-based buffer overflow (CWE-122) triggered during the parsing of JP2 files. It occurs due to insufficient validation of user-supplied data lengths before memory copying, which can be exploited by an unauthenticated attacker if the victim opens a malicious file.

The vulnerability carries a CVSS score of 7.8, indicating a high severity level. Successful exploitation allows for arbitrary code execution in the context of the user running the application, which could lead to full system compromise, data theft, or lateral movement within the network. Because the attack vector relies on file parsing, any business process involving the handling of external images is at significant risk.

Immediate Action: Update GIMP to the latest version, which includes the fix committed in the upstream repository (commit cd1c88a0364ad1444c06536731972a99bd8643fd).

Proactive Monitoring: Monitor file integrity and application logs for abnormal crashes or unexpected process behavior when the GIMP application handles image files.

Compensating Controls: Implement endpoint protection software that can detect and block malicious file execution and restrict users from opening untrusted JP2 files from unknown sources.

Public Exploit Available: No (exploit_available: unknown)

Given the severity of potential remote code execution, users and administrators should prioritize upgrading their GIMP installations to the patched version immediately. Organizations should also provide user awareness training regarding the risks of opening image files from untrusted or unverified sources to reduce the attack surface.