Vulnerability Report

CVE-2012-3236

Title: Gimp Memory Corruption

Memory Corruption

Proof Of Concept

PoC Available for CVE-2012-3236

CWE Category CWE-476

Published Date Jul 12, 2012

Modified Date Apr 29, 2026

Exploit Status Available

Score 4.3 CVSS v2.0

Exploit Probability (EPSS)

10.08%

Vulnerability Summary

CVE-2012-3236: fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.

Impacted Vendors

gimp 1

gnu 1

Reference Links

http://archives.neohapsis.com/archives/bugtraq/2012-06/0192.html http://git.gnome.org/browse/gimp/commit/plug-ins/file-fits/fits-io.c?id=ace45631595e8781a1420842582d67160097163c http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00000.html http://www.exploit-db.com/exploits/19482 http://www.mandriva.com/security/advisories?name=MDVSA-2013:082 http://www.reactionpenetrationtesting.co.uk/FIT-file-handling-dos.html http://www.securityfocus.com/bid/54246 http://www.ubuntu.com/usn/USN-1559-1 https://bugzilla.gnome.org/show_bug.cgi?id=676804 https://exchange.xforce.ibmcloud.com/vulnerabilities/76658 http://archives.neohapsis.com/archives/bugtraq/2012-06/0192.html http://git.gnome.org/browse/gimp/commit/plug-ins/file-fits/fits-io.c?id=ace45631595e8781a1420842582d67160097163c http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00000.html http://www.exploit-db.com/exploits/19482 http://www.mandriva.com/security/advisories?name=MDVSA-2013:082 http://www.reactionpenetrationtesting.co.uk/FIT-file-handling-dos.html http://www.securityfocus.com/bid/54246 http://www.ubuntu.com/usn/USN-1559-1 https://bugzilla.gnome.org/show_bug.cgi?id=676804 https://exchange.xforce.ibmcloud.com/vulnerabilities/76658

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2012-3236 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/19482

View Code

April 29, 2026 MODIFIED

Vulnerability data updated via NVD.

April 11, 2025 MODIFIED

Vulnerability data or affected products updated.

July 12, 2012 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected Stack

No specific products linked.