red-hatCVE-2026-96545
An out-of-bounds heap read flaw was found in GIMP's TIM image loader.
Medium4.4CVE-2026-96545 · Published Sep 23, 2026 · updated Sep 24, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10 Vendor | all versions | No fix yet |
| Red Hat Enterprise Linux 6 Vendor | all versions | No fix yet |
| Red Hat Enterprise Linux 7 Vendor | all versions | No fix yet |
| Red Hat Enterprise Linux 8 Vendor | all versions | No fix yet |
| Red Hat Enterprise Linux 9 Vendor | all versions | No fix yet |
Details and references
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
- Severity from
- no source yet
- Weakness
- CWE-125