A flaw was found in GIMP's file-icns plugin. When decompressing the mask resource during ICNS image processing, the plugin reads from the mask data buffer without checking bounds. If the ICNS file contains a truncated mask, the plugin reads past the end of the buffer. This out-of-bounds read leaks heap contents as alpha‑channel pixel values or aborts the application, resulting in either sensitive data disclosure or a denial of service. The weakness is classified as CWE‑125.

Systems running Red Hat Enterprise Linux 6, 7, 8, or 9 that have GIMP installed are affected, as the GIMP packages provided by Red Hat include the vulnerable file‑icns plugin. The issue is linked specifically to the GIMP component rather than the underlying OS itself, but any deployment of GIMP on those RHEL releases may be impacted.

The CVSS score of 7.1 indicates high severity. The EPSS score of < 1% indicates a very low but non-zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack requires local access to open a crafted ICNS file with GIMP; therefore the most likely vector is a local, user‑initiated file upload or a malicious file presented to a user who is running GIMP.