CVE-2026-96545: GIMP TIM Image Loader Use-After-Free Flaw

CVE-2026-96545 Overview

CVE-2026-96545 is an out-of-bounds heap read in the GIMP file-tim plug-in. The flaw affects the TIM image loader when parsing crafted 4bpp (4 bits-per-pixel) TIM files. When the loader promotes the decoded pixels to an RGBA layer, it allocates a row buffer sized for the source format but iterates using the larger RGBA row width. The mismatch reads adjacent heap memory into the decoded image and can crash the plug-in. Exploitation requires a local user to open a malicious file, so the impact is limited to information exposure and denial of service within the GIMP process.

Critical Impact
A crafted TIM file processed by GIMP leaks adjacent heap bytes into the rendered image and can terminate the plug-in.

Affected Products

GNU Image Manipulation Program (GIMP) file-tim plug-in
Distributions shipping the affected GIMP TIM loader (see Red Hat CVE-2026-96545)
Downstream builds tracked in GNOME GIMP Work Item 16791

Discovery Timeline

2026-09-23 - CVE-2026-96545 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96545

Vulnerability Analysis

The defect lives in the TIM (PlayStation texture) importer that ships with GIMP. TIM files can encode pixels at 4bpp, 8bpp, 16bpp, or 24bpp. When the plug-in decides the target GIMP layer must be RGBA, it converts each source row into a wider destination row.

The allocation for the intermediate row buffer is sized against the source pixel width. The subsequent copy or promotion loop, however, uses the RGBA-sized row length. The loop therefore reads past the end of the smaller allocation and copies adjacent heap contents into the layer being constructed.

Because the read is out of bounds on the heap, two outcomes are possible. The plug-in may crash if it walks off a mapped page. Alternatively, residual heap data ends up embedded in the imported image, exposing whatever GIMP had stored nearby in memory. The issue is classified as an out-of-bounds read [CWE-125].

Root Cause

The root cause is a size mismatch between allocation and iteration in the 4bpp-to-RGBA promotion path of the file-tim plug-in. The row buffer is undersized relative to the RGBA stride used during decoding, and no bounds check catches the discrepancy.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malformed 4bpp TIM file and delivers it through any channel that ends with a user opening the file in GIMP. Automated thumbnailers that invoke GIMP loaders on untrusted content could also trigger the read. No privileges are needed beyond those of the user running GIMP.

No verified exploit code is public. See Red Hat Bug 2539597 for reproducer details as they become available.

Detection Methods for CVE-2026-96545

Indicators of Compromise

Unexpected crashes of the GIMP file-tim plug-in when opening images with a .tim extension
Rendered TIM images containing garbled or non-image data bands consistent with leaked heap contents
Delivery of .tim attachments or downloads to workstations that run GIMP

Detection Strategies

Alert on GIMP process crashes and plug-in aborts recorded by the operating system crash reporter
Inspect email and web proxy logs for TIM files delivered to workstations that do not normally handle PlayStation texture assets
Correlate GIMP execution telemetry with the opening of TIM files sourced from untrusted origins

Monitoring Recommendations

Track process launches of gimp and its plug-in binaries on user endpoints and record parent process context
Monitor for AddressSanitizer or glibc heap error messages emitted by GIMP if debug builds are deployed
Log file-open telemetry for GIMP and flag rare or first-seen TIM files in the environment

How to Mitigate CVE-2026-96545

Immediate Actions Required

Do not open TIM files from untrusted sources in GIMP until a fixed build is installed
Track the vendor advisories linked from Red Hat CVE-2026-96545 and apply distribution updates when published
Disable or remove the file-tim plug-in on systems that do not require TIM support

Patch Information

A fix is being tracked upstream in GNOME GIMP Work Item 16791. Distribution status is available through Red Hat CVE-2026-96545 and Red Hat Bug 2539597. Apply the packaged update from your Linux distribution or the official GIMP release once the corrected file-tim plug-in is available.

Workarounds

Remove the TIM plug-in binary from the GIMP plug-ins directory to prevent the loader from being invoked
Restrict file associations so .tim files do not open automatically in GIMP
Convert untrusted TIM files to a safer format in a sandboxed environment before importing into a workstation copy of GIMP

bash

# Locate and disable the TIM plug-in on Linux systems
find /usr/lib*/gimp -type f -name 'file-tim*' -print
sudo chmod a-x /usr/lib*/gimp/*/plug-ins/file-tim/file-tim