The flaw resides in the parsing of PGM image files and stems from the failure to properly initialize memory before accessing it, which is classified as CWE‑908. When a user opens a malicious PGM file, the uninitialized data can be coerced into executable code and run in the context of the running GIMP process, allowing an attacker to execute arbitrary instructions on the host. This vulnerability is triggered by user interaction; an attacker must supply a crafted PGM file through a malicious link or local file preview.

The affected installation is GIMP version 3.0.6 as indicated by its CPE. No other versions are explicitly listed, but any GIMP build that contains the uninitialized memory bug in its PGM parser may be vulnerable, so all installations should verify the presence or absence of the fix.

The CVSS base score of 8.8 reflects high severity for remote code execution, though the EPSS score is below 1 %, indicating a low likelihood of exploitation in the wild at this time. The vulnerability is not currently in the CISA KEV catalog, and no public exploit has been disclosed. The likely attack vector requires a malicious PGM file presented to the user—either via a web page, a shared file, or a deceptive download—so user awareness and file source verification remain critical, while the low EPSS suggests that active exploitation is still uncommon.