Description

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-08T16:16:49.093Z",
  "pubdate": "2026-08-08T16:16:49.093Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability resides within the GIMP DirectDraw Surface (DDS) file parser. This security defect arises from insufficient validation of pixel format headers within crafted DDS image files. Specifically, when a file declares a specific D3D9 pixel format but supplies a deceptively lower bits-per-pixel (bpp) value in the header, the application calculates an inadequate memory size allocation.\nThe primary impact of this vulnerability includes heap metadata corruption, application denial of service, and potential arbitrary code execution within the context of the user running GIMP. Attackers can leverage this flaw by engineering malicious DDS files designed to trick users into opening them. Successful exploitation requires user interaction to process the malformed image file.\nGiven GIMP's widespread usage across various operating systems for image manipulation, this vulnerability poses significant risk implications. Compromise of the parsing engine via untrusted file inputs bypasses standard boundary checks, allowing malicious payloads to manipulate adjacent heap memory structures.",
  "technicalDetails": "The vulnerability exists in the GIMP DDS file parser component responsible for handling DirectDraw Surface image files. The root cause is a discrepancy validation flaw during the initialization of pixel buffers based on file header parsing.\nWhen processing a crafted DDS file, the parser reads the declared D3D9 pixel format alongside the bits-per-pixel (bpp) value specified in the header. Due to inadequate sanity checks reconciling the declared D3D9 pixel format against the provided bpp metric, the loader calculates and allocates an undersized heap buffer.\nThe step-by-step attack flow proceeds as follows: First, an attacker constructs a malformed DDS image file where the header specifies a lower bpp value than what the actual D3D9 pixel format requires. Second, the victim opens this crafted DDS file using a vulnerable version of GIMP. Third, the GIMP DDS parser reads the manipulated header fields and allocates an insufficient heap buffer based on the understated bpp calculation.\nFourth, as the parser proceeds to read and consume the subsequent pixel data payloads from the file stream, it writes data using the real, larger format's stride rather than the allocated buffer's boundaries. Finally, this mismatch results in an out-of-bounds heap write, overflowing the undersized buffer, corrupting adjacent heap metadata, and potentially facilitating arbitrary code execution if precise memory layout manipulation is achieved by the attacker."
}