CVE-2026-6695 is a heap-based out-of-bounds write vulnerability in the decode_lzss() function of the PAA file format plugin in GIMP, as shipped with Red Hat Enterprise Linux 6. An attacker can exploit this by convincing a user to open a maliciously crafted Paint Shop Pro Array (.paa) image file, causing data to be written beyond the intended memory buffer. This memory corruption can lead to heap metadata corruption, potentially enabling arbitrary code execution on the affected system. The vulnerability requires local user interaction (opening the file) and has a CVSS 3.1 base score of 5.5 with an attack vector of local, low attack complexity, no privileges required, and user interaction required. Red Hat's advisory confirms the vulnerability and recommends mitigation steps but does not currently provide an official patch or fix.

The vulnerability allows an attacker to cause heap metadata corruption through a heap-based out-of-bounds write, which may lead to arbitrary code execution on the affected system. It also has the potential to cause denial of service by crashing the application processing the malicious file. The attack requires a user to open a crafted .paa image file locally, so remote exploitation without user interaction is not possible.

Red Hat advises users to avoid opening .paa files from untrusted sources to mitigate this vulnerability. If GIMP is not required, removing the 'gimp' package is recommended to eliminate the attack vector. There is no official patch or fix currently available; users should monitor the Red Hat advisory for updates. No contradictory vendor guidance exists.