A heap-based buffer overflow in GIMP version 3.2.0-RC1 allows for remote code execution when a user opens a specially crafted ICO file.

The vulnerability exists in the ICO file parsing logic, which fails to validate the length of user-supplied data before copying it into a heap-based buffer. An unauthenticated attacker can exploit this by tricking a user into opening a malicious file, resulting in code execution under the context of the current process.

The ability for an attacker to achieve remote code execution poses a severe threat to workstation integrity and data confidentiality. With a CVSS score of 7.8, this high-severity flaw could allow an attacker to gain full control over the user's system, potentially leading to unauthorized data access, lateral movement within the network, or the installation of persistent malware.

Immediate Action: Users should restrict the opening of untrusted ICO files and monitor vendor channels for the release of an official patched version. Until a formal update is available, users should avoid importing image files from unknown or unverified sources.

Proactive Monitoring: Security teams should monitor endpoint security logs for unexpected process spawns or suspicious behavior originating from the GIMP application.

Compensating Controls: Deploying endpoint protection software with advanced memory protection features can help detect or block heap exploitation attempts. Additionally, network-level file scanning can assist in identifying malicious ICO files before they reach end-user workstations.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability represents a significant risk to organizational endpoints. Administrators must prioritize updating GIMP as soon as the vendor releases a patch and educate users regarding the risks of opening untrusted image files.