A flaw in GIMP’s parsing of XWD files allows an out‑of‑bounds write when processing a malicious file. The lack of proper validation of the file data enables the attacker to overwrite memory beyond the intended buffer, giving control over the program’s execution flow. An attacker who successfully exploits the vulnerability can run arbitrary code with the same privileges as the GIMP process.

The vulnerability affects the GIMP application, specifically version 3.0.6 and related builds; the flaw resides in the XWD file handler, and other formats or components are not impacted.

The CVSS base score of 7.3 reflects a high risk assessment, while the EPSS score of less than 1% indicates a low likelihood of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires user interaction; an attacker must entice a user to open a malicious XWD file or have the file imported through malicious content on a web page. Given the remote code execution potential, administrators should consider the severity high enough to warrant immediate patching.