Description

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-28T16:18:34.213Z",
  "pubdate": "2026-08-28T16:18:34.213Z",
  "executiveSummary": "A critical heap-based out-of-bounds read vulnerability exists within the file-ico plugin of the GIMP image manipulation software. This flaw originates from insufficient validation of the 'used_clrs' (palette count) parameter during the parsing of malformed ICO image files.\nThe vulnerability allows an attacker to trigger an out-of-bounds read operation by providing a specially crafted image file, which, when processed by GIMP, results in memory corruption.\nThe primary impact of this vulnerability includes application instability leading to a denial of service (DoS) and the potential for unauthorized disclosure of sensitive heap memory contents.\nThe vulnerability does not inherently require authentication or high-level privileges, as the attack vector is triggered during the standard processing of an image file. An attacker would need to successfully lure a victim into opening a malicious ICO file, making this a client-side exploitation vector. There is no evidence currently suggesting that this vulnerability facilitates arbitrary code execution; however, the disclosure of heap memory could potentially assist in bypassing memory protections such as ASLR in more complex attack chains.",
  "technicalDetails": "The vulnerability resides in the parsing logic of the file-ico plugin in GIMP, specifically during the handling of ICO image headers. The ICO format utilizes a 'used_clrs' parameter to define the number of entries within the image's color palette. The plugin fails to perform rigorous bounds checking against this user-supplied value before allocating or accessing memory associated with the palette data.\nThe root cause is an improper validation of the 'used_clrs' integer. When a crafted ICO file presents an intentionally inflated or inconsistent 'used_clrs' value, the internal routine fails to verify that the value matches the actual size of the memory buffer allocated for palette storage. This discrepancy creates a logical error where the code attempts to read beyond the legitimate boundaries of the heap buffer.\nThe attack flow proceeds as follows: First, an attacker constructs an ICO file containing an invalid 'used_clrs' parameter designed to point outside the allocated memory range. Second, when GIMP initiates the loading process for the file, the file-ico plugin invokes its palette-parsing routine. Third, the routine reads the malicious 'used_clrs' value and uses it as an index or size parameter for subsequent memory operations.\nBecause the bounds check is bypassed, the plugin performs an out-of-bounds read on the heap. Depending on the memory layout and the surrounding structures, this behavior leads to one of two outcomes: a crash of the GIMP process due to a segmentation fault (resulting in a denial of service), or the inclusion of extraneous heap data in the rendered image or internal structures. If the application continues execution after an OOB read, the leakage of neighboring heap memory can occur, potentially exposing data such as pointers, sensitive strings, or other heap-resident artifacts.\nExploitation does not require network exposure, but rather relies on the victim's interaction with the malicious file. There are no authentication requirements, as the vulnerability is triggered locally during the file parsing sequence. The vulnerable component is specifically the logic handling image metadata parsing within the file-ico plugin, affecting standard GIMP installations where this plugin is enabled."
}