Every CVE Search/ Get API key

CVE-2026-96545

Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

4.4 Medium

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.18%Unchanged since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.4

Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Record
CVE-2026-96545
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weakness
CWE-125
Updated
2026-11-06
EUVDEUVD-2026-85539 4.4

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Record
EUVD-2026-85539
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-06
GitHub AdvisoriesGHSA-4528-hvwj-6gx3 4.4

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted...

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Record
GHSA-4528-hvwj-6gx3
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 4.4

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Record
CVE-2026-96545
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weakness
CWE-125
Updated
2026-11-06
OSVDEBIAN-CVE-2026-96545 4.4

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Record
DEBIAN-CVE-2026-96545
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-06
OSVUBUNTU-CVE-2026-96545 4.4

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Record
UBUNTU-CVE-2026-96545
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVMGASA-2026-0578 No score

Updated gimp packages fix security vulnerabilities

This update to v. 3.2.8 fixes several security issues.

Record
MGASA-2026-0578
Updated
2026-11-07
OSVopenSUSE-SU-2026:11890-1 No score

gimp-3.2.6-3.1 on GA media

These are all security issues fixed in the gimp-3.2.6-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11890-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gimp
Debian:14
 All versions, plus listed versions
3.0.4-33.0.4-43.0.4-53.0.4-63.0.4-6.1
Show 16 moreShow less
3.0.4-6.23.0.6-13.2.0-13.2.0~RC2-13.2.0~RC2-23.2.0~RC2-33.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.2-13.2.4-13.2.4-23.2.4-33.2.6-13.2.8-1
 None known
gimp
Mageia:10
From an advisory covering 28 CVEs
 before 3.2.8-1.mga10
3.2.8-1.mga10
gimp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3
 None known
gimp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.20-12.8.20-1.12.8.20-22.8.22-12.8.22-1ubuntu0.1~esm12.8.22-1ubuntu0.1~esm22.8.22-1ubuntu0.1~esm3
 None known
gimp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.10.8-22.10.14-22.10.14-2build12.10.14-2ubuntu12.10.14-3
Show 5 moreShow less
2.10.18-12.10.18-1ubuntu0.12.10.18-1ubuntu0.1+esm12.10.18-1ubuntu0.1+esm22.10.18-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.10.24-22.10.28-12.10.30-12.10.30-1build12.10.30-1ubuntu0.12.10.30-1ubuntu0.1+esm12.10.30-1ubuntu0.1+esm22.10.30-1ubuntu0.1+esm3
 None known
gimp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.34-12.10.36-12.10.36-22.10.36-3build22.10.36-3build3
Show 4 moreShow less
2.10.36-3ubuntu0.24.04.12.10.36-3ubuntu0.24.04.1+esm12.10.36-3ubuntu0.24.04.1+esm22.10.36-3ubuntu0.24.04.1+esm3
 None known
gimp
Ubuntu:26.10
 All versions, plus listed versions
3.2.2-13.2.4-13.2.4-23.2.4-33.2.6-1
 None known
gimp
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.4-6.13.0.4-6.23.0.6-13.2.0~RC2-23.2.0~RC2-3
Show 7 moreShow less
3.2.0~RC2-3.13.2.0~RC2-3.23.2.0~RC2-3.33.2.0~RC3-13.2.0-13.2.2-13.2.2-1ubuntu0.26.04.1
 None known
gimp
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 3.2.6-3.1
3.2.6-3.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affectedOSV
affected, factsCVE List, NVD
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-96545 is a medium vulnerability (CVSS 4.4) in Red Hat Enterprise Linux 10, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. No source names a fixed version.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open