Listen to this Post
A flaw was found in GIMP’s PAA (Paint Shop Pro Array) file format plugin. The vulnerability resides in the `decode_lzss()` function within plug-ins/common/file-paa.c. When a user opens a specially crafted `.paa` image file, the plugin allocates a heap buffer `uncompressed_data` with a size derived from attacker-controlled `width` and `height` values in the file header (estimated_size = width height 2). The LZSS decompression routine then processes compressed pixel data using a sliding window (char_array).
The root cause is a missing bounds check in the inner back-reference copy loop. The outer `while` loop condition is estimated_size > 0, but the inner `for` loop that copies decompressed bytes does not verify that `estimated_size` remains positive before writing. A crafted file can set the LZSS back-reference length (b4 = (b2 & 0x0F) + 2) to a maximum of 17–18 bytes. When only 1 byte of output space remains, this inner loop writes up to 17 bytes past the end of the allocated buffer.
A guard check at line 526 (if ((b4 + 1) > (guint32) flag)) is completely ineffective: `flag` is set as raw_data[raw_index++] | 65280, making it always ≥ 65280, while `b4 + 1` is at most 18 — this check never triggers. As `estimated_size` goes negative, `data_index` continues incrementing, causing heap metadata corruption. This can lead to denial of service or, under specific heap layouts, enable arbitrary code execution. The vulnerability is tracked as CWE-787 (Out-of-bounds Write) and CWE-805 (Buffer Access with Incorrect Length Value).
DailyCVE Form:
Platform: GIMP (Linux/Windows/macOS)
Version: < 3.2.4
Vulnerability: Heap OOB Write
Severity: Medium (5.5 CVSS)
Date: 2026-08-03
Prediction: Patch expected 2026-08-19 (already fixed in 3.2.4)
What Undercode Say:
Analytics from public telemetry and security feeds:
EPSS probability of exploitation in next 30 days: 0.15% (5th percentile) CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected distributions: Red Hat Enterprise Linux 6, 7, 8, 9 Fixed in: GIMP 3.2.4 (commit 55256210f85b79b2ef72ea2bc6c84b52cb5ff335) PoC available: Yes (17-byte PAA file) Public exploits: None known as of 2026-08-19
Check GIMP version gimp --version For Red Hat-based systems, check installed package rpm -q gimp For Debian/Ubuntu-based systems dpkg -l | grep gimp
Exploit: (Educational Purposes!)
A minimal Proof-of-Concept file (poc_write.paa, 17 bytes) triggers the overflow:
00000000: 4444 0000 0200 0100 0600 0007 4142 4300 DD..........ABC. 00000010: 0f .
| Offset | Bytes | Field | Value |
|–|-|-|-|
| 0x00 | `44 44` | PAA type | RGBA_4444 |
| 0x04 | `02 00` | Width | 2 |
| 0x06 | `01 00` | Height | 1 |
| 0x08 | `06 00 00` | Block size | 6 |
| 0x0B | `07` | LZSS flag | 3 literals + 1 back-reference |
The overflow occurs when the LZSS back-reference loop writes 18 bytes while only 1 byte of output space remains.
ASAN reproduction:
make ASAN_OPTIONS="detect_leaks=0" ./paa_fuzz poc.paa
Observed ASAN output:
==1846440==ERROR: AddressSanitizer: heap-buffer-overflow on address ...
Protection:
- Upgrade GIMP to version 3.2.4 or higher
- For Red Hat Enterprise Linux, apply the updated `gimp` package from the vendor
- For Debian unstable, upgrade to `gimp 3.2.4-1` or higher
- Avoid opening PAA files from untrusted or unknown sources
- Consider using file integrity monitoring to detect unexpected `.paa` file access
Impact:
- Confidentiality: None
- Integrity: None
- Availability: High — heap corruption can crash the application
- Remote Code Execution: Possible under specific heap layouts
- Attack requires user interaction (opening a malicious file)
- Attack vector is Local (file must be accessible to the victim)
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
