The flaw occurs in GIMP's file‑psd plugin when generating a thumbnail preview for a specially crafted PSD file. An integer overflow happens during the multiplication of values from an embedded JPEG header, producing an undersized heap allocation. This leads to a heap‑based buffer overflow that can corrupt adjacent heap objects, potentially causing the application to crash or enabling the attacker to execute arbitrary code.

Affected vendors include GNOME, which distributes GIMP, and Red Hat, which incorporates GIMP in its enterprise distributions. The vulnerable GIMP versions are present in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, meaning any system running these releases with GIMP installed is impacted.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score of < 1 % indicates a low likelihood of exploitation, and the issue is not listed in CISA’s KEV catalog. Attackers would need to supply a malicious PSD file to a user and prompt the user to open it—typically via email or by placing the file in a directory that a user navigates to with GIMP’s file chooser. The vulnerability is therefore limited to the local user context and requires user interaction to trigger the exploit.