The vulnerability arises from an integer overflow that occurs when GIMP processes a Bohemia Interactive (PAA) texture file. The overflow leads to an undersized memory buffer allocation. As the file is parsed, subsequent processing reads beyond the allocated buffer, causing the plugin process to terminate unexpectedly. The crash can be used to deny service, and the out‑of‑bounds read may expose sensitive memory contents. This flaw is categorized as an integer overflow (CWE‑190).

Red Hat Enterprise Linux 6, 7, 8, 9, and 10 – all versions that ship the affected GIMP package are impacted by this flaw.

The CVSS score of 6.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation has been documented yet. The likely attack vector is local: an attacker convinces a user to open or preview a malicious PAA texture file, which triggers the overflow and results in a crash or data exposure. Based on this information, any user of the impacted Red Hat Enterprise Linux releases should treat this as a medium‑risk issue that warrants timely patching.