CVE-2026-96545Medium· 4.4▾ TwilightPoC availableAn out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the l…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 24.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96546Low· 2.5A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader
CVE-2026-88840Medium· 5.3BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
CVE-2026-88835Medium· 6.1BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.
CVE-2026-92248High· 7.8A flaw was found in the file-psd plugin in GIMP
CVE-2026-90947High· 7.8A flaw was found in GIMP
CVE-2026-90949High· 7.8A flaw was found in GIMP's PSP (Paint Shop Pro) file loader