This vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser on Red Hat Enterprise Linux 6. When a malicious DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the parser allocates a heap buffer that is too small. Subsequent pixel data processing writes beyond this buffer, corrupting heap metadata and potentially allowing arbitrary code execution. The flaw is triggered by opening a crafted DDS image file with GIMP. The vulnerability has a CVSS 3.1 score of 7.8 (high severity) with local attack vector, low attack complexity, no privileges required, and user interaction required. Red Hat advises avoiding untrusted DDS files and removing GIMP if it is not essential. No official fix or patch is currently confirmed in the advisory.

Successful exploitation can lead to heap metadata corruption and potentially arbitrary code execution on affected systems. The vulnerability affects confidentiality, integrity, and availability, with a high impact rating. It requires local access and user interaction (opening a crafted DDS file) but no privileges. This could allow an attacker to execute code with the privileges of the user running GIMP.

Red Hat advises users to avoid opening untrusted DirectDraw Surface (DDS) image files with GIMP. As a security measure, only process DDS files from trusted sources. If GIMP is not essential, consider removing the 'gimp' package to eliminate this attack vector. There is no official fix or patch currently confirmed; users should monitor the Red Hat advisory for updates.