{"id":"CVE-2026-116723","kind":"vulnerability","aliases":["CVE-2026-116723"],"related":[],"title":"FLTK: crafted BMP file overflows stack buffer, risking code execution","description":"FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.","summary":"FLTK, a C++ GUI toolkit, has a stack-based buffer overflow in its BMP image loader when a file sets an oversized colors_used field. An attacker who supplies a crafted BMP or ICO file can corrupt stack memory, causing a crash or possibly running code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fltk","fixed":["1.5.x master commit 3a049d8 (unreleased)"],"affected":"<= 1.4.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["bmp","c++","desktop-apps","fltk","ico","image-loading","package"],"not_affected_if":["bmp-loader-unused","fltk-built-from-master-after-3a049d8","fltk-newer-than-1.4.5","no-untrusted-images"],"how_to_check":"- Run `fltk-config --version`; 1.4.5 and earlier are affected, and no released version is fixed yet.\n- Grep your code and vendored sources for `Fl_BMP_Image` (also ICO loading via Fl_ICO_Image / image-loading by file extension through Fl_Shared_Image) to see whether untrusted files reach the BMP loader.\n- If you build from git, check that commit 3a049d8 is in your history: `git merge-base --is-ancestor 3a049d8 HEAD`.","fix":"Fixed on FLTK master (1.5.x) in commit 3a049d8; no tagged release contains it yet and no 1.4.x backport was found as of 2026-10-26. Until then, build from master at or after 3a049d8 (weekly snapshot 41b02b0358c3 or later), or apply that commit to your 1.4.5 tree. Alternatively avoid loading untrusted BMP/ICO files.","status":"open","published_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:27:36+00:00","updated_at":"2026-10-26T22:28:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T22:27:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"FLTK: crafted BMP file overflows stack buffer, risking code execution","impact":"high","summary":"FLTK, a C++ GUI toolkit, has a stack-based buffer overflow in its BMP image loader when a file sets an oversized colors_used field. An attacker who supplies a crafted BMP or ICO file can corrupt stack memory, causing a crash or possibly running code.","category":"package","nicknames":[],"who_cares":["fltk","c++","desktop-apps","image-loading"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker-supplied image crashes the app or may run code","analyst_note":"Check the FLTK project's release notes or commit history for the fixed version and whether a patch exists; the sources give no fix.","how_to_check":"- Check the FLTK version in use: `fltk-config --version` or the version in the project's build files, and see whether it is `1.4.5` or earlier.\n- Search the codebase and vendored sources for `Fl_BMP_Image` to confirm the BMP loader is compiled in.","needs_analyst":true,"not_affected_if":["no-untrusted-images","fltk-newer-than-1.4.5"],"who_is_affected":"Applications built on FLTK through 1.4.5 that load BMP or ICO images from files or data an outside party can influence are exposed. Programs that only display fixed, trusted images or never load user-supplied bitmaps are unlikely to be reached.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":3364,"output_tokens":550,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the FLTK project's release notes or commit history for the fixed version and whether a patch exists; the sources give no fix.","search":"'-116723':13A,16A '-2026':12A,15A '1.4.5':78C '256':119C '768':123C 'allow':94C 'app':22B 'array':126C 'attack':56B,95C,108C 'base':38B,83C 'bmp':3A,18B,43B,61B,89C,92C,104C,111C 'buffer':7A,39B,84C 'byte':124C 'c':19B,31B 'caus':69B,127C 'code':9A,75B,131C 'color':52B,105C,116C 'colormap':125C 'contain':79C 'corrupt':66B,97C 'craft':2A,60B,110C 'crash':71B,128C 'cve':11A,14A 'desktop':21B 'desktop-app':20B 'execut':10A,132C 'field':54B,107C 'file':4A,48B,64B,114C 'fl':88C 'fltk':1A,17A,23B,29B,76C 'gui':32B 'ico':24B,63B,113C 'imag':26B,44B,90C 'image-load':25B 'load':27B,91C 'loader':45B 'memori':68B,99C 'overflow':5A,40B,85C,121C 'overs':51B,103C 'packag':28B 'possibl':73B 'potenti':130C 'risk':8A 'run':74B 'set':49B 'stack':6A,37B,67B,82C,98C 'stack-bas':36B,81C 'suppli':58B,101C 'toolkit':33B 'use':53B,106C,117C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Applications built on FLTK through 1.4.5 that load BMP or ICO images from files or data an outside party can influence are exposed. Programs that only display fixed, trusted images or never load user-supplied bitmaps are unlikely to be reached.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116723","severity":null,"published_at":"2026-10-26T22:16:55+00:00","modified_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116723:843","url":null,"severity":null,"published_at":"2026-10-26T22:28:24+00:00","modified_at":"2026-10-26T22:28:24+00:00","first_seen_at":"2026-10-26T22:28:24+00:00","fetched_at":"2026-10-26T22:28:24+00:00","note":"Maintainer issue fltk/fltk#1632 confirms fix in master commit 3a049d8 (FLTK 1.5, snapshot 41b02b0358c3 of 2026-10-25); no 1.4.x release with the fix found yet (latest 1.4.5). No exploitation or PoC seen (reporter did static review only). Nothing marked verified."}],"documents":[{"id":4597,"url":"https://github.com/fltk/fltk/issues/1632","title":"FLTK BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP File (#1632)","kind":"issue","source":"analyst","text":"Maintainer ManoloFLTK 2026-10-22: commit 3a049d8 fixes it in the next release, FLTK 1.5. Labeled fixed, Prio 3 Moderate. Reported by Haind03 via static review, no runtime exploit developed.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":4598,"url":"https://www.fltk.org/articles.php?L2068=","title":"FLTK 1.5.x Weekly Snapshot (master) 2026-10-25","kind":"release","source":"analyst","text":"Snapshot git revision 41b02b0358c3 changelog includes: Fix 'BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP File' (#1632).","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}