{"id":"CVE-2026-117555","kind":"vulnerability","aliases":["CVE-2026-117555"],"related":[],"title":"CImg: crafted BMP file triggers heap out-of-bounds read in image loader","description":"CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.","summary":"CImg, a C++ image-processing header library, has an integer overflow in its BMP loader (_load_bmp in CImg.h) that wraps the row byte count. A crafted BMP with a large width can make the loader read past a heap buffer, crashing the program or leaking heap memory into the decoded image.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","cimg","image-processing","package"],"not_affected_if":["bmp-loader-unused","no-untrusted-bmp-input"],"how_to_check":"- Check whether the project includes CImg.h, for example with `grep -rn \"CImg.h\" .` or in the build's include paths.\n- Check the CImg version in use; the sources say versions through `4.0.6` are affected.\n- Check whether the code loads BMP files from untrusted sources with `CImg<T>::load` or `load_bmp`.","fix":null,"status":"open","published_at":"2026-10-27T14:16:36+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:33:02+00:00","updated_at":"2026-10-27T14:33:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T14:33:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CImg: crafted BMP file triggers heap out-of-bounds read in image loader","impact":"medium","summary":"CImg, a C++ image-processing header library, has an integer overflow in its BMP loader (_load_bmp in CImg.h) that wraps the row byte count. A crafted BMP with a large width can make the loader read past a heap buffer, crashing the program or leaking heap memory into the decoded image.","category":"package","nicknames":[],"who_cares":["c++","image-processing","cimg"],"confidence":0.6,"needs_auth":"no","worst_case":"Program crashes or leaks heap memory contents into decoded images","analyst_note":"Find a fixed CImg release or upstream commit for _load_bmp and confirm the affected version range beyond 4.0.6.","how_to_check":"- Check whether the project includes CImg.h, for example with `grep -rn \"CImg.h\" .` or in the build's include paths.\n- Check the CImg version in use; the sources say versions through `4.0.6` are affected.\n- Check whether the code loads BMP files from untrusted sources with `CImg<T>::load` or `load_bmp`.","needs_analyst":true,"not_affected_if":["no-untrusted-bmp-input","bmp-loader-unused"],"who_is_affected":"Applications that compile CImg.h and decode BMP files supplied by users or other untrusted sources are exposed, since the bad input comes from the file itself. Programs that only load trusted local images, or do not use CImg's BMP loader, can likely skip it. The sources do not say whether a patched CImg release exists.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3342,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117555':17A,20A '-2026':16A,19A '4.0.6':82C 'attack':109C 'bmp':3A,41B,44B,55B,95C,114C 'bound':10A,89C 'buffer':68B 'byte':51B,107C,124C 'c':21B,29B 'caus':99C,125C 'cimg':1A,22B,27B,80C 'cimg.h':46B,98C 'contain':83C 'count':52B,108C 'craft':2A,54B,113C 'crash':69B,126C 'cve':15A,18A 'decod':78B,133C 'disclosur':130C 'dx':123C 'file':4A,115C 'function':96C 'header':33B,119C 'heap':6A,67B,74B,85C,128C 'imag':13A,24B,31B,79B,134C 'image-process':23B,30B 'integ':37B,102C 'larg':58B,118C 'leak':73B 'librari':34B 'load':43B,94C 'loader':14A,42B,63B 'make':61B 'memori':75B,129C 'out-of-bound':7A,86C 'overflow':38B,103C 'packag':26B 'past':65B 'process':25B,32B 'program':71B 'read':11A,64B,90C 'row':50B,106C 'suppli':111C 'trigger':5A 'vulner':91C 'width':59B,120C 'wrap':48B,122C","nicknames":[],"mitigations":[],"who_affected":"Applications that compile CImg.h and decode BMP files supplied by users or other untrusted sources are exposed, since the bad input comes from the file itself. Programs that only load trusted local images, or do not use CImg's BMP loader, can likely skip it. The sources do not say whether a patched CImg release exists.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117555","severity":null,"published_at":"2026-10-27T14:16:36+00:00","modified_at":"2026-10-27T14:16:36+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}