CVE-2026-96545
MEDIUMCVSS 4.4Description
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
Timeline
Published:September 23rd, 2026 7:19 PM
Last modified:November 6th, 2026 3:16 AM
CVSS Scoring
CVSS v3: 4.4 (MEDIUM)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute