CVE-2023-44444: GIMP PSP file parsing off-by-one leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.8 with high EPSS (99th percentile) and remote code execution impact, though user interaction and no KEV listing temper urgency.

What it is

GIMP contains an off-by-one error (CWE-193) when parsing PSP image files, where crafted data causes an incorrect heap write location calculation. A remote attacker can exploit this to execute arbitrary code in the context of the GIMP process. The flaw is rated CVSS 3.0 7.8 (HIGH) and requires user interaction.

Impact

An attacker who gets a crafted PSP file opened gains arbitrary code execution with the privileges of the GIMP process, potentially leading to full compromise of the user's session and data.

Attack surface

Reached locally by opening a malicious PSP file or visiting a malicious page that triggers GIMP to parse it; the CVSS vector (AV:L, PR:N, UI:R) indicates no authentication is needed but user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is 0.56404 (99th percentile), indicating a high predicted likelihood of exploitation activity. References are release notes and a ZDI advisory, with no public exploit tag.

What to do

• Upgrade GIMP to version 2.10.36 or later, which the release notes indicate addresses this issue.
• Apply vendor or distribution patches (e.g., Debian LTS advisory) where upgrading is not immediately possible.
• Restrict opening of untrusted PSP files and block PSP attachments at email and web gateways.
• Run GIMP with least privilege and avoid processing files from untrusted sources.
• Consider sandboxing or isolating GIMP when handling untrusted image formats.

Detection

• Monitor for GIMP processes spawning unexpected child processes or making unusual network connections after opening image files.
• Hunt for crashes or abnormal terminations of GIMP when parsing PSP files, which may indicate exploitation attempts.
• Track file creation or download of PSP files from untrusted sources and correlate with GIMP execution.
• Review endpoint logs for heap corruption indicators or exploit-related behavior in the GIMP process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.