CyberRota Analysis
AI-GeneratedThe file-icns plugin in GIMP is vulnerable due to an out-of-bounds read when processing ICNS images, allowing attackers to exploit crafted files that contain truncated mask resources. This can lead to information disclosure of sensitive heap contents or cause a denial of service through potential crashes. Organizations using GIMP, particularly those handling untrusted image files, should prioritize patching this vulnerability to mitigate risks.
Original NVD Description
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
Related CVEs
Other vulnerabilities affecting the same vendor(s)