CVE-2023-44442: GIMP PSD parsing heap buffer overflow enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.8 with high confidentiality, integrity and availability impact plus a very high EPSS score, though exploitation requires user interaction and no KEV listing is present.

What it is

GIMP fails to validate the length of user-supplied data before copying it into a heap buffer while parsing PSD files, causing a heap-based buffer overflow. An attacker can craft a malicious PSD file that, when opened, leads to arbitrary code execution in the context of the GIMP process. The flaw affects GIMP installations and was addressed in the 2.10.36 release.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the user running GIMP, allowing file access, data theft or further compromise of the host.

Attack surface

The vulnerability is reached locally by opening a crafted PSD file or visiting a malicious page that triggers the file to be loaded. No authentication is required, but user interaction (opening the file or visiting the page) is necessary per the CVSS vector AV:L/UI:R.

Exploitation

The record shows no CISA KEV listing and no public exploit references, but EPSS is 0.61427 (99.1st percentile), indicating a high predicted likelihood of exploitation activity. Reference tags are limited to release notes and a third-party advisory, so no confirmed in-the-wild exploitation is documented here.

What to do

• Upgrade GIMP to version 2.10.36 or later, which contains the fix for this PSD parsing flaw.
• If immediate patching is not possible, restrict opening of untrusted PSD files and block PSD attachments at email and web gateways.
• Run GIMP with least privilege and avoid processing PSD files from untrusted sources on production or administrative systems.
• Apply vendor or distribution updates (for example Debian LTS advisories) that backport the fix to packaged versions.

Detection

• Monitor for GIMP processes spawning unexpected child processes or making unusual network connections after opening PSD files.
• Scan email and file transfer channels for PSD files from external or untrusted senders and alert on their delivery.
• Use endpoint detection to flag crashes or heap corruption events in GIMP when parsing PSD content.
• Track GIMP version inventory and alert on hosts still running versions prior to 2.10.36.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.