A flaw in the GIMP file‑pvr plug‑in allows an attacker to trick a user into opening a malformed PowerVR (.pvr) file, causing an integer overflow when calculating buffer sizes and leading to a heap‑based buffer overflow. The overflow can be leveraged to execute arbitrary code or crash the application, resulting in a denial of service. Once the attacker controls memory, execution of malicious payloads is possible.

The vulnerability is present on systems running GIMP installed on Red Hat Enterprise Linux versions 6 through 10. The affected component is the GIMP file‑pvr plug‑in, which parses .pvr files and is distributed with the GIMP package available for these operating systems.

The CVSS score of 7 indicates moderate‑to‑high severity. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog, so there is no known active exploitation at the time of this analysis. The attack vector is inferred to be local or social‑engineering, as an attacker must entice a user to open or preview a malicious .pvr file. The potential for arbitrary code execution makes the risk significant for compromised or privileged user accounts.