A heap-buffer-overflow in GIMP’s animated‑PNG loader can be triggered by opening an image that contains an fcTL chunk whose width field is larger than the width in the preceding IHDR chunk; this causes pixel data to be written beyond the end of the allocated heap block. A second heap overflow occurs in the DDS plug‑in when a BPP mismatch in load_layer() leads to a similar out‑of‑bounds write. Both overflow paths can be exploited to execute arbitrary code. The weakness is classified as CWE‑131: Incorrect Calculation of Buffer Size.

The vulnerability is present in the GIMP component delivered with Red Hat Enterprise Linux 6, 7, 8, and 9. All installed versions that include the affected GIMP binary are impacted; the list does not specify stricter version limits.

The CVSS score of 7.3 indicates a high level of risk. No EPSS score is currently available and the vulnerability is not listed in the CISA KEV catalog, which suggests an unknown exploitation probability. The error can be triggered simply by opening a malicious image file, so the likely attack vector is local; an attacker with sufficient privileges to run GIMP can potentially gain code execution on the host. Until a vendor patch is issued, the risk remains significant for systems that accept untrusted graphic input.