An integer overflow exists in GIMP’s HDR file parser due to insufficient validation of user-supplied data. The overflow can occur when an attacker prepares a crafted HDR file that causes the program to allocate an incorrectly sized buffer, allowing the attacker to execute arbitrary code in the context of the GIMP process. The flaw is a classic buffer overflow vulnerability identified by CWE‑190. The impact includes full compromise of the user’s system if the attacker successfully installs malicious payloads.

The affected product is GIMP, distributed by the GIMP project. No specific version numbers are listed in the advisory; however, the issue resides in the HDR parsing functionality and may affect all releases that lack the patch demonstrated in the linked commit.

The CVSS score is 7.8, indicating a high severity. The EPSS score is not available, so the likelihood of real‑world exploitation is uncertain, but a known exploitation reference (ZDI-CAN‑29289) suggests if an attacker can deliver a malicious HDR file the vulnerability can be abused. The vulnerability requires user interaction, such as clicking a malicious link or opening a file, and is not listed in CISA’s KEV catalog. The attack vector is remote but requires active user engagement. The exploitation conditions are simple and do not demand complex prerequisites beyond delivering the file to a GIMP user.