Vulnerability Description
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/GreycLab/CImg
- https://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659
- https://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5
- https://github.com/GreycLab/CImg/issues/495
- https://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bou
FAQ
What is CVE-2026-117555?
CVE-2026-117555 is a vulnerability with a CVSS score of 6.1 (MEDIUM). CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file w...
How severe is CVE-2026-117555?
CVE-2026-117555 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-117555?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.