Live › vulnerability › CVE-2026-116724
Go to dashboardFLTK, a C++ GUI toolkit, miscalculates the pixel buffer size for BMP images from file-supplied width and height due to an integer overflow in Fl_BMP_Image::load_bmp_(). A crafted BMP or ICO file makes the decoder write past the heap buffer, which can corrupt application memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications built on FLTK 1.4.5 or earlier that decode BMP or ICO files supplied by users, from the network, or from other untrusted sources are exposed. Programs that only load bundled, trusted image assets are unlikely to be reachable by an attacker; the sources do not say more.
No product ranges from the sources yet.
fltk-config --version or the version in the project's dependency lockfile, and see whether it is 1.4.5 or earlier.1.4.5 once a patched version is published (unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.
This page as .md · .json · in your agent: get_signal("CVE-2026-116724")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.