A heap‑based buffer overflow occurs when GIMP parses PSP files, because the length of user‑supplied data is not properly validated before copying it into a heap buffer. When a malicious file or a crafted file opened from a web page is processed, the overflow allows an attacker to execute arbitrary code in the context of the current user session. The vulnerability can compromise confidentiality, integrity, and availability by permitting an attacker to run any code with the privileges of the GIMP process.

The flaw affects GIMP software, specifically version 3.0.8 as identified by the vendor naming. No other versions are listed in the provided data, so the recommendation focuses on that release.

The CVSS score of 7.8 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and the attack vector requires user interaction through opening a malicious file, meaning it is not remotely exploitable without the user’s action. Nevertheless, the potential impact warrants attention due to the possibility of full code execution.