CVE-2023-44443

What it actually does

The flaw is an integer overflow in GIMP's Paint Shop Pro (PSP) file parser. A crafted PSP image can cause size calculations to wrap before a memory write, leading to memory corruption. If exploitation is successful, attacker-controlled code can run inside the GIMP process with the privileges of the user who opened or previewed the malicious file. Because the vulnerable component is a file parser, exploitation requires user interaction, such as opening a malicious image, importing it into GIMP, or visiting a page or workflow that causes the file to be handled by GIMP.

Why it matters to the business

Successful exploitation can compromise a user's workstation, allowing theft or alteration of local files accessible to that user, credential theft from the endpoint, malware execution, or further movement into business systems. The risk is elevated because the EPSS score is very high, indicating a strong likelihood of exploitation activity compared with most vulnerabilities, even though it is not currently listed in CISA KEV and no ransomware use is reported. Organizations that use GIMP for design, marketing, publishing, research, or file review workflows should treat untrusted image handling as a meaningful endpoint compromise risk.

How an attack unfolds

An attacker prepares a malformed PSP file that abuses the parser's integer calculation so that GIMP allocates or computes an incorrect buffer size and then writes beyond the intended memory region. The attacker delivers the file through phishing, file-sharing platforms, collaboration tools, websites, support tickets, design asset exchanges, or other channels where users are likely to open image files. When a user opens or imports the crafted PSP file in a vulnerable GIMP build, the parser processes attacker-controlled fields, triggers the integer overflow, corrupts memory, and may divert execution to attacker-controlled code. If successful, the payload runs as the current user, enabling local data access, malware staging, persistence attempts, or follow-on activity using that user's permissions.

How to fix it

Upgrade GIMP to a version that includes the upstream fix, or ensure builds include commit 1651e6e767965cf055e05d13e075095d226f1c66. Where vendor-packaged GIMP versions are used, apply the latest security update from the operating system or software distribution vendor rather than relying only on source commit status. If immediate patching is not possible, reduce exposure by blocking or quarantining untrusted PSP files, disabling automatic opening of PSP files with GIMP, restricting GIMP use to trusted files only, and using endpoint controls to prevent GIMP from spawning script interpreters, shells, download utilities, or unknown executables. Treat file-based mitigations as temporary because similar parser bugs may be triggered through normal user workflows.

How to confirm the fix worked

Confirm installed GIMP versions and package build metadata across endpoints, and verify that the deployed source or vendor package includes the fix corresponding to commit 1651e6e767965cf055e05d13e075095d226f1c66. Test file association policies to ensure PSP files are not automatically opened by vulnerable GIMP builds. Review software inventory, EDR telemetry, and package manager records for outdated GIMP installations. For source-built deployments, compare the local repository or build artifact against the fixed commit. For packaged deployments, validate the installed package version against the vendor's security advisory or changelog for this vulnerability.

Typical attack path

1. Identify organizations or users likely to open image or design files with GIMP.
2. Create or obtain a malicious PSP file crafted to trigger the integer overflow in GIMP's PSP parser.
3. Deliver the file through phishing, a malicious web page, file-sharing service, collaboration platform, or compromised asset repository.
4. Convince the target user to open or import the PSP file in a vulnerable GIMP installation.
5. Trigger memory corruption during PSP parsing and execute code in the context of the GIMP process.
6. Use the compromised user context to drop additional payloads, access local files, steal credentials or tokens, or attempt lateral movement.

How to detect it

Look for signs that GIMP opened or processed PSP files from untrusted sources, followed by crashes, abnormal child processes, new executable files, persistence changes, or outbound network activity. Useful log sources include EDR process telemetry, operating system application crash logs, shell history, file creation events, email and web gateway attachment logs, proxy logs, DNS logs, and file association/open-with telemetry where available. On Linux, review system journal, kernel, apport, coredump, and audit logs for GIMP segmentation faults or abnormal process trees. On Windows, review Event Viewer Application Error entries, Windows Error Reporting artifacts, Sysmon process creation events, and EDR detections involving gimp.exe. On macOS, review Unified Logs, crash reports under user and system DiagnosticReports paths, quarantine metadata for downloaded PSP files, and process execution telemetry. High-signal behavior includes GIMP opening a .psp file shortly before a crash, GIMP spawning a shell or scripting runtime, GIMP writing executable content, or outbound connections initiated by GIMP or a child process after file parsing.

• .psp
• gimp
• gimp.exe
• gimp-2.10.exe
• gimp-2.99.exe
• gimp-console
• gimp-console.exe
• app_name="gimp"
• process.name:gimp.exe
• process.name:gimp
• parent_process_name="gimp.exe"
• parent_process_name="gimp"
• gimp: segfault
• segfault at
• core dumped
• GIMP crashed
• Application Error
• Faulting application name: gimp.exe
• Windows Error Reporting
• /var/lib/systemd/coredump/
• /var/crash/
• ~/Library/Logs/DiagnosticReports/gimp
• /Library/Logs/DiagnosticReports/gimp
• cmd.exe spawned by gimp.exe
• powershell.exe spawned by gimp.exe
• sh spawned by gimp
• bash spawned by gimp
• python spawned by gimp
• curl spawned by gimp
• wget spawned by gimp

What your security team should do

• Prioritize patching or replacing vulnerable GIMP installations, especially on workstations used to process external images, design assets, email attachments, or customer-supplied files.
• Search endpoint inventory for GIMP installations from source builds, third-party repositories, portable bundles, and unmanaged user-installed copies, not only centrally managed packages.
• Temporarily block or detonate externally sourced PSP files in email, web download, collaboration, and file-transfer channels until vulnerable installations are remediated.
• Harden endpoint controls so GIMP cannot spawn shells, scripting engines, installers, archive tools, or network download utilities without alerting.
• Hunt for suspicious GIMP child processes, crashes followed by new executable creation, or network connections shortly after PSP files are opened.
• Educate users in image-handling roles to avoid opening unsolicited PSP files or design assets from untrusted sources.
• Because the EPSS score is very high, treat remediation as time-sensitive even though the vulnerability is not currently in CISA KEV.