GIMP’s PSD file parser suffers from an unchecked integer overflow during buffer allocation, enabling an attacker to execute arbitrary code while the program is running. The flaw arises from the lack of proper validation of user-supplied data before allocating memory, and exploiting it requires the user to open a malicious PSD file or visit a web page that triggers the parsing process. If successful, the attacker can run code with the same permissions as the user running GIMP.

The vulnerability affects the GIMP image editing application distributed by the GIMP project. No specific product versions were listed in the advisory, so any installation of GIMP that has not applied the latest available patch may be vulnerable.

The CVSS score of 7.8 indicates a high severity level, and while no EPSS score is available, the lack of exploit data suggests a moderate likelihood of real-world attacks. GIMP is not listed in the CISA KEV catalog. The required user interaction—opening a malicious file or visiting a malicious page—means the attack vector is local file-based but triggered remotely, increasing the attack surface for attackers who can deliver the file via email or web link. Both the severity and the potential impact warrant prompt remediation.