CyberRota Analysis
AI-GeneratedA heap-based buffer overflow vulnerability in the GIMP DDS file parser allows attackers to exploit crafted DDS files that declare a D3D9 pixel format with a lower bits-per-pixel value, resulting in heap buffer overflows. This can lead to heap metadata corruption and potentially allow for arbitrary code execution. Organizations using GIMP, particularly those handling DDS files, should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.