CVE-2026-96545
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An out-of-bounds heap read flaw exists in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
Risk Assessment
Opening a crafted TIM file can leak memory contents into the image and crash the plug-in, potentially enabling information disclosure or a DoS attack. The risk affects users who open untrusted image files.
Recommendation
Update GIMP to a version containing the fix for the TIM loader bug. Avoid opening untrusted TIM files until the update is applied.
Other vulnerabilities in GIMP
See all- CVE-2017-17789High
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
- CVE-2017-17787High
In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.
- CVE-2017-17786High
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.
- CVE-2017-17785High
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
- CVE-2017-17784High
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.
- CVE-2016-4994High
A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- CVE-2026-97185High
In GIMP, when processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
- CVE-2026-96546Low
GIMP's uncompressed DDS image loader has a one-byte out-of-bounds heap read flaw. After processing the final pixel, the file-dds plug-in performs an unconditional one-byte look-ahead, which may cause a crash if the byte is inaccessible.
- CVE-2026-92248High
A heap-based buffer overflow vulnerability exists in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD file, an integer overflow occurs during multiplication of values from an embedded JPEG header, leading to an undersized heap allocation and a heap-based buffer overflow during image decoding.
- CVE-2026-90947High
GIMP when processing a specially crafted lighting preset file does not properly validate the number of light sources in the Lighting Effects filter. This can lead to an out-of-bounds write, potentially causing a crash or enabling arbitrary code execution.
Original NVD description (English source)
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS