GIMP may crash when importing a specially crafted SBZ palette file that lacks a color-model attribute. The flaw triggers a null pointer dereference during string comparison, which results in a denial of service of the GIMP application. The weakness aligns with CWE‑476 – dereferencing a null pointer. No disclosure of sensitive data or elevation of privileges is possible; the impact is limited to application availability.

Red Hat provides the GIMP package in Red Hat Enterprise Linux 10, 6, 7, 8, and 9. The vulnerability is present in the versions of GIMP distributed for these operating systems, regardless of the specific patch level. Users running any of these distributions with the bundled GIMP installation are affected until the flaw is remedied.

The CVSS score of 5.5 places the vulnerability in the medium range, and it is not listed in the CISA KEV catalog, indicating no currently known widespread exploitation. Local users can trigger the crash simply by opening or importing an SBZ palette file that meets the exploit criteria. Remote exploitation would require the ability to deliver a crafted file through a user‑initiated import or an application that automatically processes such files. Because the flaw only causes a denial of service, the risk to confidentiality or integrity is negligible. The EPSS score is unavailable, but given the nature of the attack vector and the lack of public exploit data, the likelihood of exploitation appears modest.