The TIM image loader has a stack buffer overflow in the 4BPP decoding path. A variable-length array row[] is allocated as width bytes, but the decode loop writes 2 * width bytes into it, unconditionally overflowing by exactly width bytes with data derived from the file. Opening any crafted 4BPP TIM file triggers the overflow and crashes GIMP.