The vulnerability in GIMP’s XWD file parser permits a remote attacker to overwrite memory outside the bounds of a buffer, leading to arbitrary code execution under the user’s process context. This flaw arises from insufficient validation of user-supplied data during XWD parsing, a classic example of the type of out‑of‑bounds write identified in CWE‑787. The impact is that any user who opens a crafted XWD file or visits a malicious webpage that triggers the parser could have code executed with the privileges of the GIMP process, potentially compromising the entire system.

This issue affects GIMP version 3.2.0 release candidate 1 as specified by the CPE entry. The vulnerability is associated with the GIMP product from the GIMP vendor. No other versions or vendors are listed in the current data.

The severity score of 7.8 indicates a high level of risk, but the EPSS score of less than 1% suggests that active exploitation is unlikely at present. The vulnerability is not included in the CISA KEV catalog, and exploitation requires user interaction—open a malicious file or visit a compromised page—so the attack vector can be considered remote but dependent on user action. Given the lack of exploitation evidence and reliance on the victim’s willingness to open a file, the overall threat remains significant but less likely than vulnerabilities that can be triggered automatically.