The vulnerability is a heap‑based buffer overflow that occurs when GIMP parses TIF files. The flaw arises from failing to validate the length of user supplied data before copying it into a heap buffer. An attacker can craft a malicious TIF file and, if a user opens or visits a page that triggers its parsing, arbitrary code will be executed in the context of the GIMP process. This allows full control of the application and potentially the underlying system.

All installations of GIMP that include the vulnerable TIF parsing code are affected. The specific affected versions are not listed in the advisory, but any release prior to the commit that introduced the fix is vulnerable. The advisory does not provide a product or vendor version matrix beyond the general GIMP product.

The CVSS score of 7.8 classifies the flaw as high severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction – the target must open a crafted TIF file or visit a page that triggers its parsing – so it is a user‑initiated remote code execution vector. Given the lack of a known public exploit, the risk depends on the likelihood that users will encounter malicious TIF content, but attackers could embed such files in social engineering campaigns or compromised websites.