An integer overflow occurs while GIMP parses TIFF image files due to inadequate validation of the data supplied in the file. When the overflow happens, the program allocates a buffer that is too small to hold the requested data, allowing an attacker to overwrite memory. The resulting memory corruption can be exploited to run arbitrary code in the context of the GIMP process. The vulnerability requires that the victim open a specially crafted TIFF file or otherwise interact with malicious content, so the attacker must first trick the user into opening the file or visiting a page that loads it.

The flaw affects the GIMP image editor. No specific versions are listed in the advisory, so all released versions of GIMP that have not yet applied the upstream commit are potentially vulnerable.

The CVSS score of 7.8 classifies this as a high‑severity issue. Although EPSS data is not available, the lack of a KEV listing does not diminish the risk; the requirement for user interaction presents a low‑to‑moderate exploitation probability, but once a user opens the malicious file the attacker can execute code with full privileges granted to the user. The most direct exploitation path is the user opening a crafted TIFF file ad‑hoc, while a more advanced attacker might embed such a file in a webpage that the user visits.