A heap-based buffer overflow flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, ico-load.c calculates the required buffer size using an unchecked 32-bit signed multiplication of the image's width and height. Specially crafted dimensions can overflow this calculation, causing an undersized buffer to be allocated, while libpng continues decoding the image using the original, unvalidated dimensions. This results in a heap-based buffer overflow when the decoded pixel data is written past the end of the allocated buffer. An attacker could exploit this by crafting a malicious ICO file that, when opened in GIMP, leads to a crash or arbitrary code execution in the context of the user running GIMP.