The flaw resides in GIMP’s XCF loader, which processes image-simulation-intent and image‑simulation‑bpc parasites without first confirming that the parasite data is present. When a specially crafted XCF file contains a zero‑size simulation parasite, the loader attempts to dereference a null pointer, resulting in a crash of the GIMP application. The effect is a denial‑of‑service condition for the user running the program, without any apparent escalation of privileges or data disclosure.

Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10 are listed by Red Hat as affected. Users who install and run GIMP on these platforms are at risk, as the package includes the vulnerable loader code.

The CVSS score of 5.5 classifies the vulnerability as medium severity. No EPSS score is available, so current exploitation probability is unknown, and the flaw is not included in the CISA KEV catalog. The attack vector is inferred to be local or remote via a malicious XCF file presented to a user with GIMP installed; the vulnerability does not involve a network‑exposed service directly.