A critical integer overflow vulnerability in GIMP 3.0.8 allows remote attackers to execute arbitrary code when a user opens a specially crafted ANI file.

The vulnerability is an integer overflow (CWE-190) occurring during the parsing of ANI files, caused by insufficient validation of user-supplied data prior to buffer allocation. An unauthenticated attacker can exploit this by enticing a user to open a malicious file, leading to code execution within the context of the current process.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the host system. Given the CVSS score of 7.8, this poses a high risk of total system compromise, including potential data theft or the deployment of further malicious software, which could result in significant operational disruption and loss of confidentiality.

Immediate Action: Users should restrict the opening of untrusted ANI files and monitor official GIMP project channels for the release of a security update addressing the fix commit 09e5459de913172fc51da3bd6b6adc533acd368e.

Proactive Monitoring: Security teams should review endpoint logs for unusual child processes spawned by the GIMP application, especially those following the opening of image files.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to block or sandbox the execution of applications that handle untrusted file formats from external sources.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate vigilance. Administrators should prioritize identifying and patching installations of GIMP 3.0.8 as soon as the vendor provides a stable update. Until a patch is applied, users must avoid opening ANI files from untrusted or unknown sources to mitigate the risk of arbitrary code execution.