Technical impact
A heap buffer over-read in GIMP's PCX file loader occurs when an off‑by‑one error allows an attacker to craft a PCX image that, when loaded, can expose out‑of‑bounds memory contents and crash the application. The flaw, classified as CWE‑193, can lead to a disclosure of sensitive data and a denial of service, compromising confidentiality and availability but not directly affecting system integrity. Successful exploitation requires that a user opens the malicious file.
Affected Systems
The vulnerability affects GIMP installations on Red Hat Enterprise Linux 6 through 9. Any user who has the gimp package installed on these distributions is potentially susceptible, regardless of the specific GIMP version distributed with the OS.
Risk and Exploitability
With a CVSS v3.1 score of 6.1, the severity is moderate. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. The attack requires social engineering; an adversary must convince a user to open a malicious PCX image. Because the flaw is only exploitable through such user interaction and does not involve a direct remote code execution vector, the overall likelihood of exploitation in uncontrolled environments is lower, though not negligible.
