CVE-2026-96545: Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a crafted 4bpp TIM image has a palette large enough to enable promotetorgb, the loader creates an RGBA layer but allocates the row buffer using the smaller indexed-image size. The file-tim plug-in allocates width times two bytes for a two-row buffer, while geglbufferset() interprets the same buffer as RGBA data and reads width times eight bytes. This reads width times six bytes beyond the row buffer for every pair of rows. Adjacent heap contents are copied into the decoded image as pixel data, potentially exposing process memory if the resulting image is saved or shared; the invalid read may also crash the plug-in. The issue was reproduced with AddressSanitizer and differential images in GIMP 3.2.6, and the same code was present in the main branch. All versions are reported as affected. This is distinct from CVE-2026-40916, whose fix enlarged the row buffer for indexed layers but did not account for promotetorgb, and CVE-2026-59089, which addressed separate palette-size arithmetic. A patch was available, but no fixed release had been identified at the time of reporting.
Other sources
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who open crafted 4bpp TIM images in GIMP are exposed. The issue can disclose adjacent process heap contents through decoded image pixels and may crash the file-tim plug-in.
What must an attacker provide to trigger the flaw?
An attacker needs to convince a user to open a specially crafted 4bpp TIM image whose palette is large enough to trigger promote_to_rgb. User interaction is required, while no privileges are required.
Are default installations affected?
All versions are reported as affected, including GIMP 3.2.6 and the main branch. No fixed release had been identified at the time of reporting, although a patch was available.
How can I determine whether an image may have exposed data?
The flaw occurs when a crafted 4bpp TIM image triggers promotion to RGB, causing bytes beyond the allocated row buffer to be copied into the decoded image. If the resulting image was saved or shared, its pixel data could contain adjacent heap contents from the GIMP process.
What can be done until a fixed release is available?
Avoid opening untrusted 4bpp TIM images, particularly those that may contain large palettes. Do not save or share images decoded from untrusted TIM files, because the output may include unintended process-memory data.