A heap-based buffer overflow flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, read_selection_block() allocates a buffer sized to the selection rectangle's dimensions, while read_channel_data() derives the amount of data to decompress from the full image dimensions instead. A specially crafted PSP file can exploit this mismatch to decompress data far exceeding the allocated buffer, causing a heap-based buffer overflow. An attacker could exploit this by crafting a malicious PSP file that, when opened in GIMP, leads to a crash or arbitrary code execution in the context of the user running GIMP.