Vulnerability Report

CVE-2023-44442

RCE

Title: Gimp RCE

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2023-44442.

CWE Category CWE-122

Published Date May 03, 2024

Modified Date Nov 04, 2025

Exploit Status Not Found

Score 7.8 CVSS v3.0

Exploit Probability (EPSS)

58.32%

Vulnerability Summary

CVE-2023-44442: GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.

Impacted Vendors

gimp 1

gnu 1

Reference Links

https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/ https://www.zerodayinitiative.com/advisories/ZDI-23-1594/ https://lists.debian.org/debian-lts-announce/2023/11/msg00015.html https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/ https://www.zerodayinitiative.com/advisories/ZDI-23-1594/

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2023-44442 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

November 04, 2025 MODIFIED

Vulnerability data or affected products updated.

May 03, 2024 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector LOCAL

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.