This vulnerability in GIMP's file-fli plugin is caused by a signed integer overflow during memory allocation for image buffers when processing FLI image files. The calculation of the buffer size multiplies the image width and height, which can overflow the integer limit, leading to incorrect memory allocation. A remote attacker can exploit this by convincing a user to open a maliciously crafted FLI file, causing GIMP to crash and resulting in denial of service. The vulnerability requires user interaction and local access to the system. The CVSS v3.1 base score is 5.5 (medium severity) with an attack vector of local, low attack complexity, no privileges required, and user interaction required. The flaw is tracked as CWE-190 (Integer Overflow or Wraparound). No known exploits are reported in the wild. The vendor advisory from Red Hat confirms the issue and recommends avoiding untrusted FLI files as mitigation. No official patch or fix has been released yet.

Successful exploitation leads to denial of service by crashing the GIMP application due to integer overflow during memory allocation. There is no impact on confidentiality or integrity. The attack requires local user interaction to open a malicious FLI file. No remote code execution or data corruption is confirmed. The vulnerability affects application availability only.

No official patch or fix is currently available for this vulnerability. Users should mitigate risk by avoiding opening FLI image files from untrusted or unknown sources. Exercising caution with the origin of FLI files can prevent the denial of service. Monitor vendor advisories for updates regarding patch availability.