A vulnerability exists in GIMP’s parsing of XCF files. When an attacker supplies a crafted XCF file containing a malformed text-layer parasite, the program performs a heap out-of-bounds read. This read can expose adjacent heap memory contents into the layer’s text field, potentially leaking sensitive data. Additionally, the read can corrupt internal state, causing GIMP to crash and resulting in a denial of service for the user.

The flaw affects Red Hat Enterprise Linux distributions 6, 7, 8, 9 and 10, which ship the GIMP package. The supply chain reference points to the GIMP component bundled with these platforms. Affected versions are those available in the specified Red Hat releases; no specific GIMP version range is singled out beyond the default packages.

The CVSS score of 7.1 indicates a high severity, and the vulnerability is not currently listed in the CISA KEV catalog. The exploitability of the flaw is contingent on the attacker’s ability to supply a malicious XCF file to a user who opens it within GIMP. Because the attack vector is local or requires user interaction with the file, the likelihood of widespread remote exploitation is limited, though the impact to the affected systems can be significant, causing data leakage or service interruption.