Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in GIMP XCF text-layer handling. Parasite payloads can be stored as exact file-sized heap copies without a NUL terminator, then processed with unbounded C-string APIs in gimp_text_from_parasite(). This over-reads heap memory in the main process; leaked bytes can appear as layer text / errors and persist into a re-saved XCF. A crafted file can also crash GIMP.