The flaw is a heap‑based buffer overflow, identified as CWE‑120 and CWE‑122, that is triggered during the parsing of TIF files in GIMP. The code does not validate the user‑supplied data length before copying it into a heap buffer, allowing an attacker to craft a malicious TIF file and gain execution in the context of the GIMP process. This vulnerability can be leveraged to run arbitrary code with the privileges of the user running the application, leading to full compromise of the application and potentially the host system.

All installations of GIMP that include the vulnerable TIF parsing module are affected. The advisory references the commit that introduced the fix, so any release prior to that commit is vulnerable. The CVE does not list specific versions, but users should check whether their version predates the commit 77e1a11636fae53c922fe92273b8f4e33c7a9176.

The CVSS score of 7.8 classifies this as high severity. The EPSS score is less than 1%, indicating a very low exploitation probability at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers must obtain user interaction – the victim must open a malicious TIF file or visit a page that loads it – to trigger the overflow. With social engineering or compromised websites, the attack surface could increase, yet the overall risk remains moderate given the low EPSS.