The vulnerability arises from a heap-based buffer overflow in the GIMP DDS plug‑in. A crafted DDS file that declares a D3D9 pixel format but supplies a lower bits‑per‑pixel (bpp) value in its header leads the loader to allocate a buffer that is too small. When the plugin reads pixel data at the stride appropriate for the declared format, writes are performed outside the allocated region, corrupting heap metadata and creating the possibility for arbitrary code execution. The flaw is a classic misuse of format data, classified as CWE‑131.

Affected products are GIMP image editors that include the DDS (DirectDraw Surface) plug‑in. Specific vendor and product names are simply GIMP and its DDS plug‑in. Version details are not supplied in the CVE record, so any installation that contains the un‑patched DDS plugin may be vulnerable. Users should verify whether their GIMP build includes the bundled DDS plug‑in.

The CVSS base score is 7.8, indicating a high severity. Exploit probability is not quantified by EPSS, and the issue is not yet listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is local file usage, but could be achieved remotely if an attacker can cause GIMP to load a malicious file from a network share or an email attachment. The vulnerability can be triggered by simply opening a crafted DDS file that an attacker can supply to a user. Successful exploitation would allow the attacker to overwrite memory on the target system’s heap, potentially leading to arbitrary code execution with the privileges of the GIMP process.