{"id":"CVE-2026-116724","kind":"vulnerability","aliases":["CVE-2026-116724"],"related":[],"title":"FLTK: crafted BMP or ICO file overflows heap buffer during image load","description":"FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.","summary":"FLTK, a C++ GUI toolkit, miscalculates the pixel buffer size for BMP images from file-supplied width and height due to an integer overflow in Fl_BMP_Image::load_bmp_(). A crafted BMP or ICO file makes the decoder write past the heap buffer, which can corrupt application memory.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","desktop-apps","fltk","image-parsing","package"],"not_affected_if":["trusted-assets-only"],"how_to_check":"- Check the FLTK version in use: `fltk-config --version` or the version in the project's dependency lockfile, and see whether it is `1.4.5` or earlier.\n- Find code that loads images with Fl_BMP_Image or Fl_Shared_Image from untrusted or user-supplied files.","fix":"- Upgrade FLTK to a release newer than `1.4.5` once a patched version is published (unknown from the sources).\n- Until patched, reject or do not load BMP and ICO files from untrusted sources.","status":"open","published_at":"2026-10-26T22:16:56+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:27:36+00:00","updated_at":"2026-10-26T22:27:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FLTK to a release newer than `1.4.5` once a patched version is published (unknown from the sources).\n- Until patched, reject or do not load BMP and ICO files from untrusted sources.","reach":"unknown","title":"FLTK: crafted BMP or ICO file overflows heap buffer during image load","impact":"high","summary":"FLTK, a C++ GUI toolkit, miscalculates the pixel buffer size for BMP images from file-supplied width and height due to an integer overflow in Fl_BMP_Image::load_bmp_(). A crafted BMP or ICO file makes the decoder write past the heap buffer, which can corrupt application memory.","category":"package","nicknames":[],"who_cares":["fltk","c++","desktop-apps","image-parsing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Heap corruption in the application, possibly leading to code execution","analyst_note":"Find the patched FLTK version and the affected version range from the NVD entry or the FLTK project; the sources give only 'through 1.4.5' and no fix version.","how_to_check":"- Check the FLTK version in use: `fltk-config --version` or the version in the project's dependency lockfile, and see whether it is `1.4.5` or earlier.\n- Find code that loads images with Fl_BMP_Image or Fl_Shared_Image from untrusted or user-supplied files.","needs_analyst":true,"not_affected_if":["trusted-assets-only"],"who_is_affected":"Applications built on FLTK 1.4.5 or earlier that decode BMP or ICO files supplied by users, from the network, or from other untrusted sources are exposed. Programs that only load bundled, trusted image assets are unlikely to be reachable by an attacker; the sources do not say more.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":3353,"output_tokens":660,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116724':15A,18A '-2026':14A,17A '1.4.5':80C 'alloc':97C 'app':22B 'applic':76B,131C 'attack':105C 'bmp':3A,39B,55B,58B,61B,88C,91C,110C 'buffer':9A,36B,72B,96C,128C 'c':19B,30B 'caus':93C 'contain':81C 'corrupt':75B,129C 'craft':2A,60B,109C 'cve':13A,16A 'data':124C 'decod':67B,119C 'deriv':123C 'desktop':21B 'desktop-app':20B 'dimens':116C 'due':48B 'file':6A,43B,64B,100C,113C,122C 'file-deriv':121C 'file-suppli':42B,99C 'fl':54B,87C 'fltk':1A,23B,28B,78C 'gui':31B 'heap':8A,71B,127C,132C 'height':47B,104C 'ico':5A,63B,112C 'imag':11A,25B,40B,56B,89C 'image-pars':24B 'integ':51B,83C 'larg':115C 'load':12A,57B,90C 'make':65B 'memori':77B 'miscalcul':33B 'overflow':7A,52B,84C 'packag':27B 'pars':26B 'past':69B,125C 'pixel':35B,95C 'row':118C 'size':37B 'suppli':44B,101C,107C 'toolkit':32B 'unders':94C 'vulner':85C 'width':45B,102C 'write':68B,120C","nicknames":[],"mitigations":[],"who_affected":"Applications built on FLTK 1.4.5 or earlier that decode BMP or ICO files supplied by users, from the network, or from other untrusted sources are exposed. Programs that only load bundled, trusted image assets are unlikely to be reachable by an attacker; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116724","severity":null,"published_at":"2026-10-26T22:16:56+00:00","modified_at":"2026-10-26T22:16:56+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}