A flaw in the GIMP image editor allows processing of a specially crafted PVR image file with large dimensions to trigger a stack‑based buffer overflow and an out‑of‑bounds read in the PVR loader. The overflow causes the application to crash, resulting in a denial of service. The vulnerability does not provide a path to execute arbitrary code or compromise data confidentiality or integrity; the primary impact is loss of availability for the application instance that loaded the file.

The vulnerability affects users of GIMP running on Red Hat Enterprise Linux 6, 7, 8, and 9. Any installation that processes untrusted PVR image files is at risk, regardless of the host operating system version.

The CVSS base score of 5.5 indicates moderate severity; no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. To exploit the flaw an attacker must supply a malicious PVR file to the GIMP process, typically by sending the file to a user who opens it. The attack vector is inferred as local or remote via application input. There is no known exploitation of lateral privilege escalation or data breach.