CVE-2026-96545

Name of the Vulnerable Software and Affected Versions GIMP versions prior to 3.2.6-3.1

Description An out-of-bounds heap read flaw exists in the TIM image loader. When processing a specially crafted 4bpp TIM image that triggers promotion to an RGBA layer, the file-tim plug-in allocates a row buffer that is too small but processes it using the larger RGBA row size. This error can lead to the copying of adjacent heap contents into the decoded image or cause the plug-in to crash.

Recommendations Update to version 3.2.6-3.1.