The bug in GEGL causes an out‑of‑bounds read when a Radiance HDR loader processes an uncompressed scanline that is shorter than the width declared in the file header. Because the loader reads past the end of the mapped image data, a crafted HDR file will crash any application that uses GEGL to load the image, resulting in a denial‑of‑service condition for the user or process. This matches the CWE‑125 classification of an improper bounds check in an array read.

The vulnerability affects Red Hat Enterprise Linux versions 6, 7, 8, 9 and 10. Any delivery of the GEGL libraries on these distributions is potentially impacted, and any application that relies on GEGL to decode HDR files could trigger the crash.

The CVSS score of 5.5 indicates a moderate severity. EPSS is not available and the CVE is not listed in the CISA KEV catalog, suggesting no widespread exploitation data yet. The attack vector is inferred to be local; an attacker would need to provide a malicious HDR file to an application that uses GEGL, such as a photo editor or command‑line tool, in order to trigger the crash. Because the failure is a crash rather than an arbitrary code execution, the risk is limited to service disruption unless the application runs with elevated privileges.