This flaw is a stack‑based buffer overflow in GIMP’s parsing of APNG files, occurring because the length of user‑supplied data is not validated before copying it to a stack. The vulnerability is classified as "CWE‑120" and "CWE‑121" and allows a remote attacker to execute arbitrary code in the context of the GIMP process once the flaw is triggered. The impact is a full compromise of the system for which the affected GIMP instance runs, exposing confidentiality, integrity, and availability to the attacker.

The vendor impacted is GIMP, the GNOME image editor. No specific version ranges are provided in the database entry; any installation of GIMP running the unpatched APNG parser is potentially vulnerable.

With a CVSS score of 7.8, the severity is high, and the exploit requires user interaction—specifically, opening a crafted APNG file or visiting a malicious web page that triggers the parser. The EPSS score is 0.00363 (less than 1%), indicating a low probability of exploitation, and the vulnerability is not listed in KEV, suggesting no widespread exploitation yet. However, the combination of a critical stack overflow and the ability to gain arbitrary code execution warrants close attention, as the attack vector is straightforward for an attacker who can deliver a malicious image to an end‑user.