GIMP’s PSD parser contains an integer overflow in the read_RLE_channel() routine, a CWE‑190 flaw. When a crafted PSD file is opened, the overflow leads to an undersized heap allocation for the RLE row‑length table. Subsequent per‑row writes then corrupt heap memory, which can trigger a denial of service or, in vulnerable conditions, arbitrary code execution by an attacker who can supply a malicious file.

The vulnerability affects the GIMP package bundled with Red Hat Enterprise Linux 6 through 9. All RHEL releases that include an unpatched GIMP installation are considered vulnerable. No specific GIMP version range is listed, so administrators should treat all bundled releases as affected until a patch appears in a RHEL erratum.

The CVSS score of 7.3 indicates a high severity weakness capable of compromising confidentiality, integrity, or availability. The EPSS score is less than 1%, implying that observed exploitation in the wild is very unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a crafted PSD file and have a user open it, which is inferred because the failure occurs during the parsing of the file. Thus, the likely attack vector is local or indirect file-based; the risk is limited to environments where users can open unknown files. Still, because the flaw can lead to arbitrary code execution, the overall risk remains significant until a patch is applied.