In GIMP 2.8.22, there is a stack-based buffer over-read in xcfloadstream in app/xcf/xcf.c when there is no '\0' character after the version string.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-17788.json"