A heap‑buffer‑overflow in GIMP’s fread_pascal_string function can be triggered by a specially crafted PSD file. The overflow results in an out‑of‑bounds read during the computation of a Pascal string’s length, causing the application to crash. The primary impact is an application‑level Denial of Service with no privilege escalation or data disclosure.

The vulnerability affects GIMP 3.2.0‑rc3 and runs on Red Hat Enterprise Linux 7, 8, and 9. Users of these operating systems who have that version of GIMP installed are susceptible.

With a CVSS score of 2.8 the severity is low, and an EPSS score of less than 1% indicates a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a user to open a malicious PSD file in GIMP, implying a local or user‑initiated attack vector with no remote or network‑level risk.