A flaw in the parsing of PSD files in GIMP allows a remote attacker to trigger an integer overflow before allocating memory. This overflow can lead to arbitrary code execution within the context of the GIMP process. The vulnerability requires user interaction; the target must open a malicious PSD file or visit a malicious page that triggers the file handling routine. The weakness is a classic integer overflow (CWE‑190).

Version 3.0.8 of GIMP distributed by the GIMP project is affected. No other product or version information is listed.

The flaw has a CVSS score of 7.8, indicating a high severity. The EPSS score is below 1%, signaling a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation depends on the user opening a crafted PSD file, which means that the attack vector is user‑initiated and requires the user to be connected to a malicious site or to receive a malicious file. The impact is full compromise of the target system through arbitrary code execution.