The vulnerability resides in the PSD plug‑in’s image resource header loader in GIMP, where an incorrect destination size is used while copying a converted resource name into a fixed stack buffer. A specially crafted PSD file triggers a stack‑based buffer overflow that can crash the application and potentially allow arbitrary code execution, depending on how the overflow is exploited.

Affected systems are Red Hat Enterprise Linux releases 6, 7, 8, 9 and 10 that ship the GIMP package.

The CVSS score of 7.8 indicates a high severity flaw. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, implying limited evidence of active exploitation yet. The attack vector is inferred to be local, requiring an attacker to provide a malicious PSD file to a user running GIMP. If successful, arbitrary code execution could compromise the local user account and potentially the system in a privilege‑escalation scenario.