CVE-2026-58386

A flaw was found in GIMP's TIM loader. File-controlled width, height, and palette size values are used directly in multiple variable-length array declarations in load_image(), allowing a crafted TIM file to force oversized stack allocations and memory corruption. This could lead to denial of service or arbitrary code execution.

A flaw was found in GIMP's TIM loader. The load_image() function uses file-controlled dimensions directly in stack-based variable-length arrays, which can lead to oversized stack allocations and memory corruption when a user opens a specially crafted TIM file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.