This vulnerability involves a heap-buffer-overflow in GIMP's APNG file loader triggered when the frame control (fcTL) width exceeds the image header (IHDR) width, causing pixel data to be written beyond allocated heap memory. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a bits-per-pixel mismatch in the load_layer() function. Both flaws can be exploited by opening maliciously crafted image files, potentially allowing arbitrary code execution. Red Hat has released a security update for GIMP in Red Hat Enterprise Linux 9 to address this issue.

Successful exploitation can lead to arbitrary code execution, denial of service (crash), or unauthorized memory access due to heap-based buffer overflows. The vulnerability requires local access with low privileges and user interaction (opening a crafted image). The CVSS v3.1 score is 7.3 (High), indicating significant confidentiality, integrity, and availability impacts.

A security update for GIMP is available for Red Hat Enterprise Linux 9 and should be applied to remediate this vulnerability. The update is distributed via Red Hat advisories RHSA-2026:50817 and includes fixes for this and related vulnerabilities. No alternative mitigations are currently available or meet Red Hat's criteria for ease of use and applicability. Users should update to the fixed GIMP package version 3.0.4-4.el9_8.9 or later as provided by Red Hat.