This vulnerability is a one-byte out-of-bounds heap read in the GIMP file-dds plug-in used to load uncompressed DDS images. The plug-in performs an unconditional one-byte look-ahead after processing the final pixel, which may access memory beyond the allocated buffer. If the byte immediately following the pixel buffer is inaccessible, this can cause the plug-in to crash. There is no evidence of information disclosure or code execution resulting from this flaw. The vulnerability has a CVSS v3.1 base score of 2.5, reflecting low impact primarily due to potential denial of service via crash. Red Hat's advisory recommends avoiding importing uncompressed DDS images from untrusted sources as no application-level mitigation preserving processing of untrusted DDS files is known. No patch or fix status is explicitly provided in the advisory.

The impact is limited to potential denial of service by crashing the GIMP file-dds plug-in when opening crafted uncompressed DDS images. There is no demonstrated impact on confidentiality or integrity, as no information disclosure or code execution has been shown. The CVSS score of 2.5 corresponds to low severity with local attack vector, high attack complexity, no privileges required, and user interaction required.

Red Hat advises avoiding importing uncompressed DDS images from untrusted sources. There is currently no application-level mitigation that allows safe processing of untrusted DDS files without risk of crash. No official fix or patch is confirmed at this time. Users should monitor the Red Hat advisory for updates regarding patch availability.