CVE-2023-44443highCWE-190

CVE-2023-44443: high-severity vulnerability in GIMP

GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor GIMP+ Monitor gimp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 94%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
5 products (277 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream EUS (v.9.0) · Red Hat Enterprise Linux AppStream EUS (v.9.2) · Red Hat Enterprise Linux AppStream EUS (v.9.4)
fix ↗
Not affected
3 products (29 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7
In short

GIMP has a flaw when opening PSP image files that allows attackers to run malicious code on your computer. An attacker can create a specially crafted PSP file that, when opened in GIMP, executes harmful programs.

Technical detail

An integer overflow vulnerability exists in GIMP's PSP file parser due to insufficient validation of user-supplied data. This allows a remote attacker to craft a malicious PSP file that triggers a memory write vulnerability, enabling arbitrary code execution in the context of the GIMP process when the file is opened.

Summary generated and translated by AI from the official description.
GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
GIMP · GIMP
Related CVEs — GIMP

In the same product, most dangerous first.

CVE-2023-44442HIGHGIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 61.2%CVE-2023-44444HIGHGIMP PSP File Parsing Off-By-One Remote Code Execution VulnerabilityEPSS 56.1%CVE-2023-44441HIGHGIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 27.3%CVE-2025-5473HIGHGIMP ICO File Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 25.0%CVE-2025-2760HIGHGIMP XWD File Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 17.2%CVE-2026-2045HIGHGIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 5.3%