Live › vulnerability › CVE-2026-116723
Go to dashboardFLTK, a C++ GUI toolkit, has a stack-based buffer overflow in its BMP image loader when a file sets an oversized colors_used field. An attacker who supplies a crafted BMP or ICO file can corrupt stack memory, causing a crash or possibly running code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications built on FLTK through 1.4.5 that load BMP or ICO images from files or data an outside party can influence are exposed. Programs that only display fixed, trusted images or never load user-supplied bitmaps are unlikely to be reached.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| fltk | vendor | <= 1.4.5 | 1.5.x master commit 3a049d8 (unreleased) |
fltk-config --version; 1.4.5 and earlier are affected, and no released version is fixed yet.Fl_BMP_Image (also ICO loading via Fl_ICO_Image / image-loading by file extension through Fl_Shared_Image) to see whether untrusted files reach the BMP loader.git merge-base --is-ancestor 3a049d8 HEAD.1.4.5 treeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-116723")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.