The vulnerability is a heap‑based buffer overflow arising in libilbm’s parsing of ILBM files, caused by a missing length validation when copying user‑supplied data into a heap buffer. This flaw can be triggered by an attacker who provides a malicious file or by instructing a user to visit a bad webpage that loads such a file, leading to the execution of arbitrary code in the context of the running process. The weakness is a classic improper validation of input size, classified as CWE‑122.

The affected product is the libilbm library. No specific vulnerable versions are listed in the advisory, so any installation that includes libilbm and processes ILBM files may be impacted. No additional vendor or product details were supplied.

The CVSS score of 7.8 assigns a medium‑high severity, indicating a substantial potential impact if the flaw is exploited. The EPSS score is not available, and the vulnerability has not been listed in CISA’s KEV catalog, suggesting limited known exploitation. However, because the attack requires only user interaction to open a malicious file or visit a malicious page that forces the library to parse ILBM data, a motivated attacker could realistically achieve remote code execution. The risk appears moderate but should not be ignored, especially in environments where ILBM files are commonly processed.