CoreCVE
Back

HIGH

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability

Published May 3, 2024

Description

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-193

References (8)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner zdi
Published May 3, 2024
Updated Nov 4, 2025
Reserved Sep 28, 2023
Link CVE-2023-44444
CISA Vulnrichment
Updated Jul 5, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2023-44444
Red Hat
Severity Important
Public date Nov 14, 2023
Links CVE-2023-44444 - Bugzilla
ENISA EUVD
Assigner zdi
Published May 3, 2024
Updated Nov 4, 2025
Exploited since n/a
Link EUVD-2023-48784
EUVD-2023-48784