The vulnerability is a heap-based out-of-bounds write in GIMP’s PAA file format plugin, specifically within the decode_lzss() routine. An attacker can craft a malicious PAA image that, when opened by a user, writes beyond the intended memory buffer, corrupting heap metadata and potentially enabling arbitrary code execution on the system. The primary consequence is remote code execution by exploiting a user-initiated file opening, which would compromise confidentiality, integrity, and availability of the affected host. The weakness corresponds to CWE-805.

Red Hat Enterprise Linux 6, 7, 8 and 9 systems that have the gimp package installed are affected. No specific GIMP version range is provided, so any distribution that includes the vulnerable plugin is potentially at risk.

The CVSS base score of 5.5 classifies the flaw as a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The attack vector is inferred to be user-initiated, likely via social engineering such as phishing with a malicious .paa attachment. An attacker must entice a user to open the crafted file; if successful, the exploit can be executed with the user’s privileges. Therefore the risk is moderate but mitigatable with timely updates or workflow restrictions.