This vulnerability arises from an integer overflow during the parsing of TIF files in GIMP. When a user opens a malicious TIF file or visits a page that forces GIMP to load one, the malformed data bypasses proper validation, causing the allocator to overflow. The resulting overflow permits an attacker to execute arbitrary code in the context of the user's GIMP process. The flaw is a classic instance of Integer Overflow (CWE‑190). The only requirement from the attacker is that the victim interacts with the malicious content.

The affected vendor is GIMP, with the product identified simply as GIMP. No specific product variants or version ranges are listed in the data, so all installations of GIMP that can process TIF files are potentially vulnerable.

The CVSS score of 7.8 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local or requires user interaction – an attacker must get the victim to open a crafted TIF file or otherwise trigger GIMP to load one. If the user trusts the file or the site, arbitrary code can be executed with the privileges of the current user. Given the lack of a publicly known, widespread exploit, the immediate risk hinges on user awareness and the availability of a patch.