GIMP 2.8.2 is vulnerable to memory corruption when reading XWD files, which could lead even to arbitrary code execution. 

In file-xwd.c user controlled values:

 L_CARD32 l_red_mask;       /* Red mask */
 L_CARD32 l_green_mask;     /* Green mask */
 L_CARD32 l_blue_mask;      /* Blue mask */ 

determine the number of iterations on:

/* Set map-arrays for red, green, blue */
  for (red = 0; red <= maxred; red++)
    redmap[red] = (red * 255) / maxred;
  for (green = 0; green <= maxgreen; green++)
    greenmap[green] = (green * 255) / maxgreen;
  for (blue = 0; blue <= maxblue; blue++)
    bluemap[blue] = (blue * 255) / maxblue;

due to the fact that there is not limit check, these operations can write beyond buffer size, overwriting return address and seh handler on windows.

I attached a test file, the corresponding output from cdb debugger is:

Description: Read Access Violation at the Instruction Pointer
Short Description: ReadAVonIP
Exploitability Classification: EXPLOITABLE

Exception Faulting Address: 0x1d1d1d1d
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Read Access Violation

eax=00000000 ebx=00000000 ecx=1d1d1d1d edx=7c9132bc esi=00000000 edi=00000000
eip=1d1d1d1d esp=0022dd30 ebp=0022dd50 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
1d1d1d1d ??              ???

Andres Gomez