{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"gimp","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NX1X2MF4S6R81AP7JZ2J2S","modified_at":"2026-09-25T08:47:32.505848430Z","published_at":"2026-09-23T19:19:54.227Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-96545","https://security-tracker.debian.org/tracker/CVE-2026-96545"],"severity":{"label":"medium","score":4.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-96545","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-96545"}],"summary":"An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized ro"}