An out-of-bounds heap write (CWE‑787) exists in GIMP’s PVR image loader. When a crafted non‑square PVR texture is opened, the pvr_decode_twiddle() routine writes pixel data beyond the allocated heap buffer because the destination offset is not bounds‑checked. This flaw can be exploited by a local attacker who convinces a user to open a malicious PVR image, potentially leading to arbitrary code execution within the file‑pvr plug‑in process.

The vulnerability impacts all GIMP installations that include the file‑pvr plug‑in, irrespective of the GIMP major or minor version. Because the CVE documentation does not list affected version numbers, any GIMP release containing the unpatched PVR loader is susceptible.

The flaw carries a CVSS score of 7.8, indicating a significant impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local attacker to trick the user into opening a malicious PVR file, so social‑engineering or compromised local media is the inferred attack vector. Once triggered, the out‑of‑bounds write allows the attacker to inject arbitrary code executed in the context of the image plug‑in.