The vulnerability is a heap-based buffer overflow in the HDR file parser of GIMP. The parser fails to validate the length of user-supplied data before copying it to a heap buffer, allowing an attacker to trigger arbitrary code execution when a user opens a crafted HDR file or visits a malicious page that prompts GIMP to load the file. This flaw gives remote attackers full control over the GIMP process in the context of the current user.

This weakness exists in all versions of GIMP that include the HDR file format support. The vendor listing simply states GIMP, and no specific version range is supplied, so any GIMP installation that processes HDR files may be affected.

The vulnerability is rated with a CVSS score of 7.8 and is not listed in the CISA KEV catalog. The EPSS score is < 1%, indicating a very low probability of exploitation. Because exploitation requires user interaction—the target must open a malicious file or visit a malicious page—attackers typically rely on social engineering or phishing. The lack of an immediate native workaround means that the risk hinges on how soon an updated GIMP release becomes available and how diligently users avoid opening untrusted HDR files.