Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The Seattle Filmworks file loader reads two file-position-derived values, index and metadata_len[1], uses only metadata_len[1] to size the allocation for photo_date, then freads index - metadata_len[1] bytes into it. Both values are attacker-controlled and independent. When index ≫ metadata_len[1], the read overflows the heap by up to several KB of attacker-controlled bytes.
In a build with _FORTIFY_SOURCE (Ubuntu default), glibc detects this at runtime and aborts. In a non-FORTIFY build the corruption is silent.

Issue Link: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16491