A critical integer overflow vulnerability in GIMP 3.0.8 could allow an attacker to achieve remote code execution if a user opens a maliciously crafted PSD file.

The vulnerability is caused by an integer overflow during the parsing of PSD files due to insufficient validation of user-supplied data. An unauthenticated attacker can exploit this flaw by tricking a user into opening a malicious PSD file, leading to code execution in the context of the current process.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the GIMP application. Given the CVSS score of 7.8, this poses a high risk of complete system compromise, data theft, or malware installation. If the application is used by privileged users, the impact to the organization's security posture is severe.

Immediate Action: Update GIMP to the version containing the fix commit 00afdabdadeb5457fd897878b1e5aebc3780af10 or the latest stable release provided by the vendor.

Proactive Monitoring: Monitor system logs for unexpected application crashes or anomalous behavior when users interact with image files.

Compensating Controls: Implement endpoint security solutions that scan files for malicious patterns and restrict the ability of applications to execute arbitrary code.

Public Exploit Available: Unknown

Organizations should prioritize updating GIMP to the patched version immediately to eliminate this code execution risk. Because the attack vector relies on user interaction, user awareness training regarding the risks of opening untrusted files is also recommended as a defense-in-depth measure.