An integer overflow arises when GIMP parses APNG files, because user-supplied data is not properly validated before a buffer is allocated. This overflow allows an attacker to spawn arbitrary code executing in the context of the GIMP process. The flaw demands user interaction; the victim must open a crafted APNG file or visit a malicious page that triggers the rendering process.

The vulnerability impacts the GIMP image editor from the GIMP project. No specific affected versions are listed in the data, so all installations that could parse APNG files remain potentially vulnerable until patched.

The CVSS score of 7.8 signals a high severity. Because the EPSS score is not available and the KEV is not listed in KEV, there is no current indication of widespread exploitation. The only prerequisite is that a user opens a malicious APNG file or visits a page that may serve them, so the risk is limited to environments where unattended graphics are handled without verification.