GIMP’s X cursor (XMC) thumbnail loader allocates a pixel buffer based on a 32‑bit signed multiplication of width and height. When processing a maliciously crafted XMC file, the product can overflow, causing the actual allocation to be smaller than the image’s real dimensions. A later GEGL buffer read then uses the larger, unwrapped dimensions, which results in an out‑of‑bounds read on the heap. The flaw can lead to a GIMP crash or corruption of process memory.

The vulnerability is present in GIMP running on Red Hat Enterprise Linux 6 through 10. No specific product or version of GIMP is listed, but the risk applies to any installation of GIMP on these operating systems that processes X cursor files.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1%, which is below 1%, indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description; it requires a user to open or preview a crafted XMC file, so remote exploitation is unlikely. If the flaw is triggered, it can simply cause a crash or memory corruption and does not grant arbitrary code execution or privilege escalation. The overall risk is moderate, emphasizing the importance of not processing untrusted files.