A critical heap-based buffer overflow vulnerability in GIMP version 3.0.8 allows for remote code execution when a user opens a specially crafted JP2 file.

This vulnerability is a heap-based buffer overflow (CWE-122) occurring during the parsing of JP2 image files. The flaw arises from insufficient length validation of user supplied data before copying it to a heap buffer, allowing an unauthenticated attacker to achieve remote code execution if a user is tricked into opening a malicious file.

Successful exploitation of this vulnerability results in full remote code execution, which grants an attacker the ability to compromise the confidentiality, integrity, and availability of the host system. Given the CVSS score of 7.8, this represents a high severity risk, as it allows attackers to run arbitrary code with the privileges of the GIMP user, potentially leading to total system compromise or lateral movement within the network.

Immediate Action: Update the GIMP installation to the latest version that includes the fix provided in commit f64c9c23ba3c37dc7b875a9fb477c23953b4666e.

Proactive Monitoring: Monitor endpoint activity for suspicious GIMP process behaviors, such as unexpected child process spawning or unauthorized network connections initiated by the application.

Compensating Controls: Implement file integrity monitoring and restrict the execution of untrusted image files, particularly those originating from unknown or external sources.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Organizations should prioritize upgrading GIMP to the patched version immediately to eliminate the risk of remote code execution. Because this vulnerability requires user interaction, security teams should supplement the patch with user awareness training regarding the risks of opening image files from untrusted or suspicious sources.