Zhixi Sun

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw exists in the file-ico plugin when processing specially crafted ICO image files. The plugin fails to properly validate the `used clrs` (palette count) parameter, leading to improper memory bounds checking and a heap out-of-bounds read. This can result in an application crash, causing a denial of service or limited information disclosure of heap memory contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw exists in the file-pvr plugin where the VQ (compressed) decoder fails to properly perform memory bounds checking when processing specially crafted PVR image files. This missing validation leads to a heap out-of-bounds read, which can cause the application to crash, resulting in a denial of service or limited disclosure of heap memory contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw in the Seattle FilmWorks plugin occurs when processing a specially crafted SFW image file. The plugin allocates a Variable-Length Array (VLA)—an array whose size is determined at runtime—on the stack without performing integer overflow checks. This results in an unbounded stack allocation, leading to an application crash and a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw in the file-xwd plugin occurs when processing specially crafted XWD image files. The plugin validates image width and bytes-per-line parameters independently instead of ensuring their combined values align with the allocated buffer size. This improper bounds checking in the `load xwd f2 d1 b1()` and `load xwd f1 d24 b1()` functions leads to a heap out-of-bounds read, which is a condition where the program reads data past the end of the intended memory buffer. This can result in an application crash causing a denial of service or a limited information disclosure of heap memory contents into the resulting image. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.