The flaw resides in the FITS image loader of GIMP. An attacker can supply a crafted FITS file that triggers an integer overflow, causing the code to allocate a zero‑byte buffer. When pixel data is then processed, a heap buffer overflow occurs. If this buffer overrun is successfully exploited, it can lead to a denial of service or, under certain conditions, arbitrary code execution, impacting the confidentiality, integrity, or availability of the affected system.

Red Hat Enterprise Linux 6, 7, 8, and 9 platforms that have the GIMP package installed are affected. The vulnerability is limited to the GIMP application itself and does not directly involve the underlying operating system components.

The CVSS base score is 5.5, indicating moderate severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Because the exploitation requires the attacker to deliver a malicious FITS file to a user running GIMP, the likely attack vector is local or remote file inclusion via a compromised or malicious client. Successful exploitation would require the attacker to be able to launch GIMP or have the victim open the file, after which the heap overflow could crash the program or potentially allow code execution.