CVE-2023-44444

What it actually does

The flaw is a heap-based memory corruption vulnerability triggered while parsing crafted PSP image data. An off-by-one calculation error can cause the application to write one byte outside the intended heap buffer, potentially corrupting adjacent heap metadata or objects. With a reliable exploit, an attacker can gain arbitrary code execution in the context of the process that opens or renders the malicious file. The vulnerability requires user interaction, such as opening a malicious PSP file or visiting content that causes the vulnerable parser to process attacker-controlled PSP data. The supplied package data lists Debian 11 chromium builds with a fixed version of 112.0.5615.138-1~deb11u1, while the vulnerability description identifies GIMP PSP parsing; treat this as a packaging/advisory mapping issue and validate exposure against both the application component that parses PSP files and the affected package inventory.

Why it matters to the business

Successful exploitation can allow an attacker to run commands as the affected user, steal files accessible to that user, install malware, pivot to other systems, or disrupt workstation availability. Because exploitation depends on convincing a user to open a crafted file or visit malicious content, the most likely scenarios are phishing, drive-by content delivery, malicious downloads, or compromised file-sharing workflows. The vulnerability is not currently listed in CISA KEV and is not identified as ransomware-used, and exploit maturity is listed as none; however, the EPSS score is elevated at approximately 56%, and the issue has been public for a long period, so unpatched systems should still be treated as meaningfully exposed.

How an attack unfolds

An attacker prepares a specially crafted PSP image file containing data designed to trigger the off-by-one heap write during parsing. The attacker then delivers the file through email, messaging, a download site, shared storage, or a web page that causes the vulnerable component to process the file. When a user opens the file or the vulnerable application renders or previews it, the parser miscalculates the heap write location and corrupts memory. A simple exploit may crash the process, while a more advanced exploit may shape heap memory to redirect execution flow and run attacker-controlled code with the privileges of the current user. After code execution, the attacker can execute payloads, access user data, establish persistence under the user profile, or use stolen credentials and local access to move further into the environment.

How to fix it

Upgrade affected packages and applications to fixed versions or later. For the supplied Debian 11 chromium package mapping, update chromium to 112.0.5615.138-1~deb11u1 or later using the distribution security repositories. Separately validate whether GIMP or any bundled PSP parsing component is present and obtain the vendor-fixed version for that application/component, because the vulnerability description specifically concerns PSP file parsing. Where immediate patching is not possible, reduce exposure by blocking or quarantining PSP attachments from untrusted sources, disabling automatic preview/thumbnail generation for PSP files, restricting use of vulnerable image-processing applications, running affected applications with least privilege, and enforcing endpoint protection controls that detect abnormal child processes spawned by image viewers, browsers, or graphics applications.

How to confirm the fix worked

Confirm package remediation by querying installed versions and comparing them to the fixed release, for example verifying that Debian 11 chromium is at 112.0.5615.138-1~deb11u1 or later. Confirm application remediation by checking the installed GIMP or PSP-parsing component version against the vendor advisory and ensuring no vulnerable copies remain in portable, bundled, or unmanaged software locations. Validate exposure reduction by testing that untrusted PSP files are blocked or quarantined by mail, web, and endpoint controls where mitigation is used. Use vulnerability scanners, software inventory, package-manager output, and EDR software inventory to ensure affected versions are not present. For high-assurance validation, monitor a patched test system while opening benign PSP files to confirm normal operation and ensure the parser/application no longer crashes when exposed to known non-malicious malformed test cases from trusted validation sources.

Typical attack path

1. Attacker identifies users or systems likely to open PSP image files or browse content that can invoke the vulnerable parser.
2. Attacker crafts a malicious PSP file that triggers the heap off-by-one write during parsing.
3. Attacker delivers the file through phishing, a malicious web page, a shared drive, chat, ticket attachment, or download link.
4. User opens, previews, or otherwise causes the vulnerable application/component to parse the PSP content.
5. The vulnerable parser corrupts heap memory; exploitation results in either a crash or arbitrary code execution in the current process context.
6. Attacker-executed code downloads or launches a follow-on payload, steals data available to the user, or establishes user-level persistence.
7. Attacker attempts privilege escalation, credential theft, lateral movement, or additional malware deployment if the initial foothold is valuable.

How to detect it

Look for evidence that a user opened or downloaded PSP files shortly before an application crash, suspicious child process, network connection, or new persistence artifact. Relevant telemetry includes EDR process trees, operating system application crash logs, browser download history, email gateway attachment logs, web proxy logs, file creation events, shell command logs, and endpoint network connections. Hunt for graphics applications, browsers, thumbnail generators, or file preview processes spawning command shells, scripting runtimes, archive tools, download utilities, or unknown executables. Review crash telemetry for heap corruption, access violation, segmentation fault, or abnormal termination in GIMP, Chromium, or related image parsing/preview components. Search email and web logs for uncommon PSP file delivery, especially from external senders or newly registered domains. Because no specific public exploit artifact is provided, focus detection on behavioral indicators: PSP file access followed by process crash, child process execution, unusual outbound connections, or creation of executables/scripts in user-writable directories.

• .psp
• Content-Type: image/x-paintshoppro
• Content-Type: application/octet-stream; name="*.psp"
• filename="*.psp"
• gimp
• gimp-2
• chromium
• segmentation fault
• Segmentation fault
• heap-buffer-overflow
• heap corruption
• malloc(): corrupted
• double free or corruption
• Access violation
• EXCEPTION_ACCESS_VIOLATION
• /usr/bin/gimp
• /usr/bin/chromium
• /var/crash/
• /var/log/apport.log
• ~/.config/GIMP/
• ~/.cache/thumbnails/

What your security team should do

• Prioritize patching systems with user-facing browsers, image editors, content-preview tools, or workflows that handle externally supplied image files.
• Resolve the product-mapping discrepancy by verifying whether exposure exists through GIMP, Chromium on Debian 11, bundled image libraries, or downstream packages that parse PSP files.
• Update Debian 11 chromium packages to 112.0.5615.138-1~deb11u1 or later where the package advisory applies, and update any vulnerable GIMP/PSP parser components to their vendor-fixed releases.
• Block or detonate PSP attachments and downloads from untrusted sources until patch coverage is confirmed.
• Hunt for recent crashes or abnormal child processes from image editors, browsers, thumbnailers, and file preview handlers, especially following access to PSP files.
• Add detections for suspicious process launches from GIMP, Chromium, or image-preview processes, such as shell, scripting engine, downloader, or credential-access tool execution.
• Educate help desk and end users to treat unexpected image-file attachments, especially uncommon PSP files, as suspicious.
• Because EPSS is elevated despite no KEV listing, track this vulnerability in routine patch SLAs rather than deferring solely due to lack of known exploitation.