An out-of-bounds heap read flaw exists in GIMP's TIM image loader component included in Red Hat Enterprise Linux 10. When a crafted 4bpp TIM image is opened that causes promotion to an RGBA layer, the file-tim plug-in allocates a row buffer that is too small but processes it using the larger RGBA row size. This mismatch results in reading adjacent heap memory beyond the allocated buffer, which can lead to disclosure of adjacent memory contents and may cause the plug-in to crash. The vulnerability is tracked as CVE-2026-96545 with a CVSS v3.1 score of 4.4 (medium severity). Red Hat's advisory does not indicate an available patch or fix at this time and recommends avoiding opening untrusted TIM files. The vulnerability could potentially leak sensitive memory contents and cause denial of service via application crash.

The vulnerability allows an attacker to cause an out-of-bounds read of heap memory when processing a crafted TIM image file. This can lead to disclosure of adjacent heap contents, which might include sensitive information such as cryptographic keys or memory addresses that could aid in further attacks. Additionally, the flaw may cause the GIMP plug-in to crash, resulting in a denial of service. The CVSS score reflects a low confidentiality impact, no integrity impact, and low availability impact. There is no indication of remote exploitation without local access, as the attack vector is local and requires user interaction.

Red Hat advises not to open TIM image files from untrusted sources as no application-level mitigation exists that allows safe processing of untrusted TIM files. There is no official patch or fix currently available for this vulnerability. Users should exercise caution and avoid handling potentially malicious TIM images until a fix is released. Monitor Red Hat's advisory page for updates on patch availability.