A signed integer overflow occurs in the file-sgi plugin of GIMP when handling RLE-compressed SGI images. The plugin reads the ysize and zsize header fields as 16‑bit unsigned integers and multiplies them before allocating memory. If a crafted file sets both values to 65535, the product overflows a 32‑bit integer and the subsequent calloc call receives a malformed size argument, causing undefined behavior that aborts the plugin. The resulting denial of service prevents the GIMP application from completing image loading, potentially interrupting user workflows or automated processes that rely on the editor.

The vulnerability impacts GIMP installations delivered by Red Hat on Red Hat Enterprise Linux 6, 7, 8 and 9. Any host running these distributions and using the bundled GIMP package is potentially affected.

The CVSS base score of 5.5 indicates medium severity. Exploitation requires a crafted SGI file; the attack vector is inferred to be local file opening by a user or automated import process. No publicly available exploit exists and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of < 1% indicates a very low probability of exploitation. Nevertheless, the denial of service can disrupt graphics workflows and should be treated with caution.