REDHAT-BUG-2555730: High severity GIMP GIMP vulnerability
A flaw was found in GIMP XCF text-layer handling. Parasite payloads can be stored as exact file-sized heap copies without a NUL terminator, then processed with unbounded C-string APIs in gimptextfromparasite(). This over-reads heap memory in the main process; leaked bytes can appear as layer text / errors and persist into a re-saved XCF. A crafted file can also crash GIMP.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this flaw?
Users or systems that open crafted GIMP XCF files are exposed. The issue is triggered while GIMP handles text-layer parasite payloads.
What does an attacker need to exploit it?
An attacker needs to provide a crafted XCF file containing a text-layer parasite payload sized to omit a NUL terminator. Processing that file can cause GIMP to read beyond the allocated heap buffer.
What is the impact beyond a crash?
Heap bytes read past the payload may appear in layer text or error output. Those leaked bytes can also be retained if the affected XCF is re-saved.