---
id: "CVE-2026-116723"
kind: "vulnerability"
aliases: ["CVE-2026-116723"]
title: "FLTK: crafted BMP file overflows stack buffer, risking code execution"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fltk", "fixed": ["1.5.x master commit 3a049d8 (unreleased)"], "affected": "<= 1.4.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bmp", "c++", "desktop-apps", "fltk", "ico", "image-loading", "package"]
not_affected_if: ["bmp-loader-unused", "fltk-built-from-master-after-3a049d8", "fltk-newer-than-1.4.5", "no-untrusted-images"]
published_at: "2026-10-26T22:16:55+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:28:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116723", "first_seen_at": "2026-10-26T22:25:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T22:28:24+00:00"}]
---

# FLTK: crafted BMP file overflows stack buffer, risking code execution

FLTK, a C++ GUI toolkit, has a stack-based buffer overflow in its BMP image loader when a file sets an oversized colors_used field. An attacker who supplies a crafted BMP or ICO file can corrupt stack memory, causing a crash or possibly running code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fltk affected <= 1.4.5 fixed 1.5.x master commit 3a049d8 (unreleased)

## How to check

- Run `fltk-config --version`; 1.4.5 and earlier are affected, and no released version is fixed yet.
- Grep your code and vendored sources for `Fl_BMP_Image` (also ICO loading via Fl_ICO_Image / image-loading by file extension through Fl_Shared_Image) to see whether untrusted files reach the BMP loader.
- If you build from git, check that commit 3a049d8 is in your history: `git merge-base --is-ancestor 3a049d8 HEAD`.

## Fix

Fixed on FLTK master (1.5.x) in commit 3a049d8; no tagged release contains it yet and no 1.4.x backport was found as of 2026-10-26. Until then, build from master at or after 3a049d8 (weekly snapshot 41b02b0358c3 or later), or apply that commit to your 1.4.5 tree. Alternatively avoid loading untrusted BMP/ICO files.

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116723
- 2026-10-26T22:28:24+00:00 analyst — Maintainer issue fltk/fltk#1632 confirms fix in master commit 3a049d8 (FLTK 1.5, snapshot 41b02b0358c3 of 2026-10-25); no 1.4.x release with the fix found yet (latest 1.4.5). No exploitation or PoC seen (reporter did static review only). Nothing marked verified.

## Documents

- [advisory] FLTK BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP File (#1632) https://github.com/fltk/fltk/issues/1632
- [fix] FLTK 1.5.x Weekly Snapshot (master) 2026-10-25 https://www.fltk.org/articles.php?L2068=

## From the sources

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_