Is CVE-2026-96545 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-96545?

CVE-2026-96545 has a CVSS v3 severity of MEDIUM (4.4).

Back

CVE-2026-96545

Description

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.