This vulnerability is an integer overflow in GIMP’s TIF file parsing code. The flaw arises because user-supplied data is not properly validated, causing an overflow before a buffer is allocated. Exploiting this overflow allows an attacker to execute arbitrary code within the context of the GIMP process. The weakness is classified as CWE‑190.

The affected product is GIMP, the image editor developed by the GNOME project. The CVE disclosure does not list specific version numbers, so any installation of GIMP that has not applied the patch referenced in commit 0a45a2b51b877829ef523131b50c0eb2a933b8a1 may be vulnerable.

The CVSS score of 7.8 indicates high severity, but the EPSS score is not available, so the likelihood of real‑world exploitation cannot be quantified. The vulnerability is not listed in CISA KEV, indicating there is no evidence of widespread active exploitation as of this analysis. Attackers require user interaction: an affected user must open a malicious TIF file or visit a malicious page to trigger the flaw. Once triggered, the attacker can run code with the privileges of the GIMP process.