An integer overflow flaw was discovered in GIMP's PVR image loader, where the function pvr_decode_rect performs unchecked multiplication of dimensions supplied in a crafted file. This incorrect calculation can result in an undersized heap allocation followed by an out‑of‑bounds read. Depending on the layout of the heap at the time, the read may leak adjacent heap contents or trigger a crash of the file‑pvr plug‑in, potentially exposing sensitive information or disrupting user operations.

The vulnerability affects the GIMP image editor. No specific product versions are listed in the advisory, so all installations that still use the outdated PVR loader are potentially impacted.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score is currently unavailable. The flaw is not listed in CISA's KEV catalog, but it can be exercised locally by an attacker who supplies a crafted PVR image. An attacker could exploit this to read nearby heap memory or cause a crash, but the description does not indicate remote code execution or denial of service beyond local file handling. Because the vulnerability requires file opening by a user, the likelihood of exploitation depends on user behavior, but the impact of information disclosure or instability warrants attention.