CVE-2026-96545: 
Linux Debian 脆弱性の分析と軽減

CVE-2026-96545 is an out-of-bounds heap read vulnerability in GIMP's TIM image loader (file-tim plug-in). When a user opens a specially crafted 4bpp TIM image that triggers promotion to an RGBA layer, the plug-in allocates an undersized row buffer but processes it using the larger RGBA row size, causing adjacent heap memory to be copied into the decoded image and potentially crashing the plug-in. The vulnerability affects GIMP (including the gimp:2.8/gimp package) as tracked by Red Hat, and was published on September 23, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). Specifically, when a crafted 4bpp TIM image has a palette large enough to trigger promote_to_rgb, the file-tim loader creates an RGBA layer but allocates the row buffer using the smaller indexed-image size — width × 2 bytes for a two-row buffer — while gegl_buffer_set() interprets the same buffer as RGBA data and reads width × 8 bytes, resulting in width × 6 bytes read beyond the allocated buffer for every pair of rows (Red Hat Bugzilla). Exploitation requires local access and user interaction (opening a malicious TIM file), making it a social-engineering-dependent attack vector. The issue was reproduced with AddressSanitizer in GIMP 3.2.6 and was also present in the main branch; it is distinct from the related CVE-2026-40916 and CVE-2026-59089 (Red Hat Bugzilla).

Successful exploitation can expose adjacent heap memory contents — potentially including sensitive process data such as cryptographic keys, PII, or memory addresses — by copying them into the decoded image as pixel data, which could then be exfiltrated if the resulting image is saved or shared. Additionally, the invalid out-of-bounds read may crash the GIMP plug-in, causing a denial-of-service condition for the affected user session. The vulnerability has no integrity impact and is scoped to the local user context, limiting lateral movement potential (Red Hat CVE, Github Advisory).

No confirmed public exploit or proof-of-concept code has been identified; the GNOME GitLab work item referenced as a potential exploit source was assessed as non-exploitable (an issue tracker page with no exploit content) (Red Hat CVE). The NVD SSVC assessment classifies exploitation status as "poc" but marks the vulnerability as not automatable, requiring user interaction. The EPSS score is 0.0, indicating very low probability of exploitation in the wild, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog inclusion (Github Advisory).

1. Craft a malicious TIM image: Create a 4bpp TIM image file with a palette large enough to trigger the promote_to_rgb code path in GIMP's file-tim plug-in, causing the loader to allocate an undersized row buffer while processing it as RGBA data.
2. Deliver the file to the target: Use social engineering (e.g., email attachment, file share, or download link) to convince a local user to open the crafted TIM file in GIMP.
3. Trigger the out-of-bounds read: When the user opens the file, gegl_buffer_set() reads width × 8 bytes from a buffer allocated for only width × 2 bytes, copying width × 6 bytes of adjacent heap memory into the decoded image per row pair.
4. Extract heap contents or cause crash: If the user saves or exports the resulting image, adjacent heap memory (potentially containing sensitive data) is embedded in the output file and can be exfiltrated. Alternatively, the invalid read may cause a segmentation fault, crashing the plug-in (Red Hat Bugzilla, Red Hat CVE).

• File System: Presence of unexpected or unsolicited .tim image files in user download directories or temporary folders; saved/exported image files containing anomalous binary data or non-image artifacts embedded in pixel data.
• Logs: GIMP crash reports or core dumps referencing the file-tim plug-in; AddressSanitizer output indicating heap-buffer-overflow reads in GIMP processes.
• Process: Unexpected termination (segmentation fault) of the GIMP file-tim plug-in process when opening TIM files; GIMP error dialogs referencing plug-in crashes during image load.

A patch has been identified upstream (referenced in the GNOME GitLab work item), though no specific fixed release version was confirmed at the time of reporting (Red Hat Bugzilla). Users should update GIMP to the latest available patched version when released. As an immediate workaround, Red Hat advises users not to open TIM image files from untrusted sources, as no application-level mitigation that preserves processing of untrusted TIM files is known (Red Hat CVE). Organizations should also restrict file access permissions and consider blocking TIM file types at email gateways or file transfer points.

The vulnerability was reported by a researcher identified as "Spektra" and acknowledged by the GIMP upstream project (Red Hat CVE). Red Hat has classified it as Medium severity and is tracking it via Bugzilla. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database entries.