GIMP CVE-2026-96545

Requires a user to open a specially crafted 4bpp TIM image in GIMP whose content forces promotion to an RGBA layer, which triggers the undersized-row-buffer read in the file-tim plug-in. Exploitation is strictly local and gated on victim user interaction (UI:R) - the attacker cannot trigger it remotely without convincing the target to open the malicious file; no authentication is required beyond running GIMP, and impact is bounded to heap-memory disclosure into the image and a possible plug-in crash rather than code execution.

This is a genuinely low-severity issue and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, 4.4) correctly reflects a local, file-driven flaw: exploitation requires a victim to open an attacker-supplied crafted 4bpp TIM image in GIMP (AV:L + UI:R), and the impact is limited to a low-severity heap-memory disclosure into the decoded image (C:L) plus a possible plug-in crash (A:L), with no integrity impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automation - this is a memory-safety bug of the kind found by fuzzing image parsers, not a priority for emergency patching. There are no conflicting signals: the local vector matches the description (opening a file), and the CWE-125 out-of-bounds READ is consistent with the C:L/I:N/A:L impact profile rather than code execution. Note that the input Tags label this a 'Buffer Overflow' and include 'Information Disclosure'; the disclosure aspect is accurate, but the underlying defect is an out-of-bounds read (adjacent heap copied into the image), not a write-based overflow, so RCE risk is not supported by the description.

An attacker crafts a malformed 4bpp TIM image that triggers promotion to an RGBA layer, then delivers it to a victim (email attachment, download, shared asset) who opens it in GIMP. The file-tim plug-in allocates an undersized row buffer but reads it at the larger RGBA row stride, copying adjacent heap bytes into the decoded image (potential information leak) or crashing the plug-in. No public exploit code was identified at time of analysis, and exploitation depends entirely on the user opening the file.