Executive brief
GIMP is a popular image editing application used by designers and photographers. A flaw in its DDS (DirectDraw Surface) file parser allows attackers to trigger a heap memory corruption issue when a user opens a specially crafted image file, potentially leading to code execution and compromise of the user's system.
Technical details
This is a heap-based buffer overflow vulnerability in the GIMP DDS plug-in file parser (CWE-131: Incorrect Calculation of Buffer Size). The vulnerable code in ddsread.c's load_layer() function incorrectly calculates the heap buffer size based on a manipulated bits-per-pixel (bpp) value in a DDS file header, while the actual pixel data is processed at the declared D3D9 format's real stride. This mismatch causes an out-of-bounds heap write. The attack is triggered locally when a user opens a malicious DDS file; user interaction is required. Successful exploitation can corrupt heap metadata and lead to arbitrary code execution with the privileges of the user running GIMP.
Affected products
- GIMP GIMP
Timeline
- 2026-08-08: disclosed