REDHAT-BUG-2533008: Buffer Overflow
A heap-based buffer overflow flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, ico-load.c calculates the required buffer size using an unchecked 32-bit signed multiplication of the image's width and height. Specially crafted dimensions can overflow this calculation, causing an undersized buffer to be allocated, while libpng continues decoding the image using the original, unvalidated dimensions. This results in a heap-based buffer overflow when the decoded pixel data is written past the end of the allocated buffer. An attacker could exploit this by crafting a malicious ICO file that, when opened in GIMP, leads to a crash or arbitrary code execution in the context of the user running GIMP.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must provide a specially crafted ICO file and have it opened in GIMP. The malicious ICO contains an embedded PNG image with dimensions chosen to overflow the buffer-size calculation.
Who is affected if exploitation succeeds?
Any GIMP user who opens the crafted ICO file may be affected. A crash or arbitrary code execution would occur in the context of that user.
Does this apply to every ICO file opened in GIMP?
The flaw requires an ICO file with an embedded PNG image whose crafted width and height cause the unchecked 32-bit signed multiplication to overflow. The provided information does not indicate that ordinary ICO files trigger the issue.